Windows Analysis Report
https://maveuve.github.io/frlpodf/marynewreleasefax.html

Overview

General Information

Sample URL: https://maveuve.github.io/frlpodf/marynewreleasefax.html
Analysis ID: 1518509
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected Remcos RAT
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Downloads suspicious files via Chrome
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected suspicious crossdomain redirect
Drops PE files
HTML page contains hidden javascript code
HTTP GET or POST without a user agent
Launches processes in debugging mode, may be used to hinder debugging
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses reg.exe to modify the Windows registry
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Antivirus detection for URL or domain
Source: privmerkt.com Avira URL Cloud: Label: malware
Found malware configuration
Source: 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "privmerkt.com:9583:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-9QRTYQ", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Yara detected Remcos RAT
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2423957132.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 6148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 5652, type: MEMORYSTR
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_0fe8744f-e

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR
HTML page contains hidden javascript code
Source: https://maveuve.github.io/frlpodf/marynewreleasefax.html HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...
Source: https://maveuve.github.io/frlpodf/marynewreleasefax.html HTTP Parser: No favicon
Source: https://maveuve.github.io/frlpodf/marynewreleasefax.html HTTP Parser: No favicon
Source: https://maveuve.github.io/frlpodf/marynewreleasefax.html HTTP Parser: No favicon
Source: https://maveuve.github.io/frlpodf/marynewreleasefax.html HTTP Parser: No favicon

Compliance
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Unpacked PE file: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: Binary string: /app/crashsubmit?appname=SumatraPDFhttp://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5.3.0.pdbSumatraPDF.pdblibmupdf.pdbSumatraPDF-no-MuPDF.pdbhttp://kjkpub.s3.amazonaws.com/sumatrapdf/prerel/SumatraPDF-prerelease-SVN_PRE_RELEASE_VER.pdb.zipsymbols_tmp.ziphttp://kjkpub.s3.amazonaws.com/sumatrapdf/rel/SumatraPDF-1.5.3.0.pdb.zipsymbols_tmp.zipSUMATRAPDF_FULLDUMPHaihaisoft PDF Reader crashedSorry, that shouldn't have happened! source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: SumatraPDF-no-MuPDF.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: SumatraPDF-1.5.3.0.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: E:\building\360project\360sd\branches\beta\Build\x86\WhiteCache.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.000000001013D000.00000002.00000001.01000000.00000005.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.000000001039B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\workspace\_AppDiscovery_AppDiscovery_1.3.0@2\dev\AppDiscovery_scanner\scanner\src\ADScan\Release\bin\ADScan\ADScan.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: xOdx>a0m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: libmupdf.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.16:49763 -> 172.111.163.227:9583
Source: Network traffic Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.16:49764 -> 172.111.163.227:9583
Source: Network traffic Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.16:49767 -> 45.74.48.2:9774
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: privmerkt.com
Detected suspicious crossdomain redirect
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: github.com to https://raw.githubusercontent.com/maveuve/vbdsz/refs/heads/main/marys%20organizer%202023%20release.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: github.com to https://raw.githubusercontent.com/maveuve/vbdsz/refs/heads/main/marys%20organizer%202023%20release.zip
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.16:49765 -> 178.237.33.50:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.16:49768 -> 178.237.33.50:80
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /frlpodf/marynewreleasefax.html HTTP/1.1Host: maveuve.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.3.1/css/bootstrap.min.css HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maveuve.github.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/api.js?compat=recaptcha HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8c7ad8c96941a6&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: maveuve.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maveuve.github.io/frlpodf/marynewreleasefax.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8c7ad8c96941a6&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/621320543:1727280800:x-uSLD9blvM2sN0MY5eDk1KX-nemuunHuqvoVAWU97E/8c8c7ad8c96941a6/596e5d08887dcbd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8c8c7ad8c96941a6/1727282678369/d41a30965b817c48f2b8012ecc5d4118160944ab876415a0adeddf7d6fb64e62/cwl0dNi4gO4wp8F HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8c8c7ad8c96941a6/1727282678373/4K3pZlDmL6zt7ib HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8c8c7ad8c96941a6/1727282678373/4K3pZlDmL6zt7ib HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=E7m3O887TFWMntR&MD=kMUKRooF HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/621320543:1727280800:x-uSLD9blvM2sN0MY5eDk1KX-nemuunHuqvoVAWU97E/8c8c7ad8c96941a6/596e5d08887dcbd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/621320543:1727280800:x-uSLD9blvM2sN0MY5eDk1KX-nemuunHuqvoVAWU97E/8c8c7ad8c96941a6/596e5d08887dcbd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /maveuve/vbdsz/raw/refs/heads/main/Marys%20Organizer%202023%20Release.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /maveuve/vbdsz/refs/heads/main/Marys%20Organizer%202023%20Release.zip HTTP/1.1Host: raw.githubusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /frlpodf/marynewreleasefax.html HTTP/1.1Host: maveuve.github.ioConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "66f41242-10f5"If-Modified-Since: Wed, 25 Sep 2024 13:38:10 GMT
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9m1ve/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8c7bc1cab943c1&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9m1ve/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8c7bc1cab943c1&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/784762221:1727280895:DpZwutPQnAJ2xMIFwpiobNTMBlYJp9CWXlp9V5GN5Yo/8c8c7bc1cab943c1/4904f693d598ee1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8c8c7bc1cab943c1/1727282716834/454bfa27911b53eaf89b77fb676ac9ea7d67d7c4009c0340595e1039d45fc476/ANn6E4_AEvWbw_F HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9m1ve/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=E7m3O887TFWMntR&MD=kMUKRooF HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8c8c7bc1cab943c1/1727282716836/wNiz968zyhOEG8- HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9m1ve/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8c8c7bc1cab943c1/1727282716836/wNiz968zyhOEG8- HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/784762221:1727280895:DpZwutPQnAJ2xMIFwpiobNTMBlYJp9CWXlp9V5GN5Yo/8c8c7bc1cab943c1/4904f693d598ee1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/784762221:1727280895:DpZwutPQnAJ2xMIFwpiobNTMBlYJp9CWXlp9V5GN5Yo/8c8c7bc1cab943c1/4904f693d598ee1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /maveuve/vbdsz/raw/refs/heads/main/Marys%20Organizer%202023%20Release.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /maveuve/vbdsz/refs/heads/main/Marys%20Organizer%202023%20Release.zip HTTP/1.1Host: raw.githubusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://maveuve.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: maveuve.github.io
Source: global traffic DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic DNS traffic detected: DNS query: privmerkt.com
Source: global traffic DNS traffic detected: DNS query: geoplugin.net
Source: global traffic DNS traffic detected: DNS query: nwemarkets.com
Source: unknown HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/621320543:1727280800:x-uSLD9blvM2sN0MY5eDk1KX-nemuunHuqvoVAWU97E/8c8c7ad8c96941a6/596e5d08887dcbd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 2740sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: 596e5d08887dcbdsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 9115Server: GitHub.comContent-Type: text/html; charset=utf-8permissions-policy: interest-cohort=()ETag: "66f42b03-239b"Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'X-GitHub-Request-Id: B0A8:16FC:DF5CDC:F64E2A:66F43DF5Accept-Ranges: bytesAge: 0Date: Wed, 25 Sep 2024 16:44:37 GMTVia: 1.1 varnishX-Served-By: cache-nyc-kteb1890089-NYCX-Cache: MISSX-Cache-Hits: 0X-Timer: S1727282678.712256,VS0,VE12Vary: Accept-EncodingX-Fastly-Request-ID: 4df56139da6771a9ee33d896ba1a2d7a1a250114
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 16:44:39 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 4IA3++4DQo/dQ/6htSqdo4nGtJCiIc21iik=$q2ffHhGJNXwllPmocache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8c8c7ae99f0d183d-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 16:44:42 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: nY4+DH6ZBhG0Oqj/RFG0xMF8vFh5uwTGybA=$alOBOjM7O2DWM6MXcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8c8c7afcbc4542b9-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 16:44:44 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: yzYdkmFQqIKp4n/d8ojQnwwKrZsIgtD8TRU=$KqvhZj5kqJ9sfX1RServer: cloudflareCF-RAY: 8c8c7b098cfe0f63-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 16:45:18 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: heThQ+4lTs7dNvOM9rk0oj2vvmHsAKe1d7U=$Ig+HqhGhMfGlFPmoServer: cloudflareCF-RAY: 8c8c7bdecf9a17f1-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 16:45:21 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: cf//PbHEE7HjoGAaztXMbRYI2394GGHDrkU=$oTsqUDjJCW31GfGkServer: cloudflareCF-RAY: 8c8c7bf23c7b4402-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 16:45:23 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: hiLtZWxjvfA5cR90Xv1b2YnN3f6C1ASxQe8=$bT7Mq3YK+vpHIjc+Server: cloudflareCF-RAY: 8c8c7bff2f2a19aa-EWR
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://HDMHDMLoading...%s
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://blog.kowalczyk.info/software/sumatrapdf/translations.htmlContribute
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://blog.kowalczyk.info/software/sumatrapdf/translators.htmlThe
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://blog.kowalczyk.infoKrzysztof
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://cn.haihaisoft.com/%E6%B5%B7%E6%B5%B7%E8%BD%AF%E4%BB%B6PDF%E9%98%85%E8%AF%BB%E5%99%A8.aspxopen
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://cn.haihaisoft.comhttp://www.haihaisoft.comcnhttp://cn.haihaisoft.com/%E6%B5%B7%E6%B5%B7%E8%BD
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2313438225.0000000000DE7000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2331062452.0000000000DDC000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2313438225.0000000000E0C000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2331062452.0000000000E11000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2340389898.0000000000DE7000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2331062452.0000000000E05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2313438225.0000000000DE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpT
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2331062452.0000000000DF6000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2313438225.0000000000DE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpV
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2331062452.0000000000DF6000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2313438225.0000000000DE7000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpn
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://itexmac.sourceforge.net/SyncTeX.htmlJ
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://mailto:EmbeddedFilesTypeFilespecD%s%dR%s%sA%s%sKids.seen.seen.seenNumsSPStD%s.%d:%d:%dInfoPag
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://mupdf.comMuPDFpdf
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://p.yusukekamiyamane.com/Yusuke
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://william.famille-blum.org/William
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.drm-x.com/pdfversion.htm1.5.7.0..http://www.haihaisoft.com/PDF_Reader_download.aspxopenSo
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.drm-x.net/http://cn.drm-x.com/LicPrepare2008.aspxLicPrepare20082013.aspx.drm-x.com/2/%s?c
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.flashvidz.tk/Zenonprogram
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.freetype.org/FreeTypefont
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.haihaisoft.com/Contact.aspx
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.haihaisoft.com/Contact.aspx%u%?.Install_DirSoftware
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.haihaisoft.com/PDF_Reader_download.aspxhttp://www.drm-x.com/pdfversion.htmMS
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.haihaisoft.comSumatraPDF
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.symantec.com/XMLSchema/dcs/disc-protection
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.symantec.com/XMLSchema/dcs/disc-results
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.winimage.com/zLibDllbad
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://www.zeniko.ch/#SumatraPDFSimon
Source: chromecache_75.1.dr String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_75.1.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_74.1.dr String found in binary or memory: https://githubstatus.com
Source: chromecache_74.1.dr String found in binary or memory: https://help.github.com/pages/
Source: chromecache_74.1.dr String found in binary or memory: https://twitter.com/githubstatus
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49749 version: TLS 1.2
Yara detected Keylogger Generic
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2423957132.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 6148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 5652, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Downloads suspicious files via Chrome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File dump: C:\Users\user\Downloads\Marys Organizer 2023 Release.zip (copy) Jump to dropped file
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
Yara signature match
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.expl.evad.win@37/33@21/12
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5148:120:WilError_03
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: C:\Users\user\AppData\Local\Temp\build.exe Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Application WHERE status != 'unchanged' AND AppIsCompletelyScanned = 'true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: SELECT filepath FROM BlackCache ORDER BY atime DESC LIMIT 2000%04d-%02d-%02d %02d:%02d:%02dSELECT filepath, mtime, size, atime FROM WhiteCache ORDER BY atime DESC LIMIT 2000COMMITDELETE FROM WhiteCache WHERE atime < datetime('now', '-%d hour', 'localtime')CREATE TABLE IF NOT EXISTS BlackCache (filepath varchar(300) UNIQUE,atime char(255));CREATE TABLE IF NOT EXISTS WhiteCache (filepath varchar(300) UNIQUE,mtime char(255),atime char(255),size INTEGER(8))BEGIN TRANSACTIONwhitecacheINSERT INTO BlackCache(filepath, atime) VALUES ('%q', datetime('now', 'localtime'))DELETE FROM BlackCache WHERE filepath = '%q'DELETE FROM WhiteCacheDELETE FROM WhiteCache WHERE filepath = '%q' UPDATE WhiteCache SET atime = datetime('now', 'localtime') WHERE filepath = '%q'INSERT INTO WhiteCache(filepath, size, mtime, atime) VALUES ('%q', %lld, '%4d-%02d-%02d %2d:%02d:%02d', datetime('now', 'localtime'))list<T> too long
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Process WHERE LastSentTime<=?6;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM ApplicationInstallLocation WHERE AppId=?1 AND InstallLocation=?2;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO Application (AppId,Stale,Name,Version,ModifiedVersion,InstallSource,Publisher,ARPRegistryKey,Architecture,IsStandalone,AppIsCompletelyScanned,MSIfile,Status,LastUpdated,LastSentTime) VALUES ((SELECT AppId FROM Application WHERE Name=?2 AND Version=?3 AND Architecture=?10),?1, ?2, ?3, ?4, ?5, ?6, ?7,?10,?35,?50,?54,COALESCE((SELECT Status FROM Application WHERE Name=?2 AND Version=?3 AND Architecture=?10 AND Status != 'deleted'),?55),?70,COALESCE((SELECT LastSentTime FROM Application WHERE Name=?2 AND Version=?3 AND Architecture=?10),?71));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Stale='true' WHERE Path BETWEEN (?1 || '\') AND (?1 || 'hex(7F)');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO ScanHistory (ScanId, AppCtrlIniSHA256, SectionName, LastDiscoverySourceScanned, LastLocationScanned, ScanStatus, ScanActive, LastUpdated) VALUES ((SELECT ScanId FROM ScanHistory WHERE AppCtrlIniSHA256=?10 AND SectionName=?11),?10, ?11,?15, ?20, ?21, ?22,?70);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM ScanHistory WHERE AppCtrlIniSHA256=?10 AND ScanStatus='interrupted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO ApplicationFile (AppId, FileId) SELECT DISTINCT ?1, FileId FROM File f, (SELECT ApplicationInstallLocation.InstallLocation, ApplicationInstallLocation.IsStandalone, Application.InstallSource, Application.Name, Application.Version, Application.ModifiedVersion, Application.MSIfile FROM ApplicationInstallLocation INNER JOIN Application ON ApplicationInstallLocation.AppId = Application.AppId WHERE Application.AppId=?1 AND Application.Status != 'deleted' AND Application.IsStandalone = 'false') a WHERE (a.IsStandalone = 'false') AND (upper(f.Path) BETWEEN (upper(a.InstallLocation) || '\ ') AND (upper(a.InstallLocation) || 'hex(7F)')) AND ((a.MSIfile=f.MSIfile) OR ((f.ProductVersion BETWEEN a.Version AND (a.Version || 'hex(7F)')) OR (f.ProductVersion BETWEEN a.ModifiedVersion AND (a.ModifiedVersion || 'hex(7F)')))) AND f.IsScriptFile=?4 AND f.IsStandalone='false';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status='deleted',Stale='true',LastUpdated=?70,LastSentTime=?71 WHERE (Status != 'deleted') AND AppId IN (SELECT x.AppId FROM File f INNER JOIN ApplicationFile x ON (x.FileId = f.FileId AND f.Status = 'deleted') GROUP BY (x.AppId) HAVING (COUNT(x.AppId) = (SELECT COUNT(*) FROM ApplicationFile WHERE AppId=x.Appid)));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT DISTINCT Application.AppId,Name,Version,InstallLocation FROM Application INNER JOIN ApplicationInstallLocation ON (Application.AppId = ApplicationInstallLocation.AppId AND Application.ARPRegistryKey=?1);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO Service (ServiceId,FileId,ServiceName,Arguments,StartType,ServiceType,UserAccount,DisplayName,Description) VALUES ((SELECT ServiceId FROM Service WHERE ServiceName=?1),?20,?1, ?3, ?4, ?5, ?6, ?7, ?8);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO File (FileId,Path,ProcessName,Sha256,Stale,CompanyName,Publisher,Sigflags,ProductName,ApplicationLaunchPoint,Version,Description,ProductVersion,OriginalFilename,Size,IsStandalone,WhitelistDrift,WhitelistSource,WhitelistedTime,IsScriptFile,ModernApp,MSIfile,Status,normalized_path,FolderID,LastUpdated,LastSentTime) VALUES ((SELECT FileId FROM File WHERE Path=?1 AND Sha256 LIKE ?4),?11, ?2,COALESCE((SELECT Sha256 FROM File WHERE Path=?1 AND Sha256 LIKE ?10),?9),?5,?20, ?18, ?19, ?21, ?22, ?23, ?24, ?25, ?26, ?27,?35,?40,?41,?42,?50,?53,?54,?55,?60,?68,?70,?71);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Stale=?5,LastUpdated=?70,LastSentTime=?71,Status='modified' WHERE Status != 'deleted' AND LastSentTime != 0 AND AppId IN (SELECT DISTINCT x.AppId FROM File f INNER JOIN ApplicationFile x ON (x.FileId = f.FileId) WHERE f.Path=?1 AND f.Sha256 LIKE ?4);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET MSIfile=?54,Status='deleted',LastUpdated=?70,LastSentTime=?71 WHERE MSIfile=?55 AND Name=?2 AND Version != ?3 AND Architecture LIKE ?10;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status=?9,LastSentTime=?8 WHERE Status != 'unchanged' AND Status != 'deleted' AND IsScriptFile=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET IsStandAlone=?7,LastUpdated=?70 WHERE Appid=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS File (FileId integer PRIMARY KEY,Stale text,Version text,Pathtext NOT NULL,Description text,ApplicationLaunchPointtext,Sha256 text,ProductName text,ProductVersion text,OriginalFilename text,ProcessName text,CompanyName text,Publisher text,Sigflags text,IsStandalonetext,WhitelistDrifttext,WhitelistSourcetext,WhitelistedTimetext,Size integer,IsScriptFiletext,ModernApptext collate nocase,MSIfiletext,Statustext,normalized_pathtext,FolderIDtext,LastUpdatedinteger,LastSentTimeinteger,UNIQUE (Path,SHA256));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE Path=?1 AND Sha256=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET ApplicationLaunchPoint=?11,ProcessName=?2,Stale=?5,LastUpdated=?70,LastSentTime=?71 WHERE Path=?1 AND Sha256 LIKE ?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS Platform (StatusId integer PRIMARY KEY,device_os_platformtext,device_os_servicepacktext,device_os_versiontext);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE status != 'unchanged' AND IsScriptFile=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT AppId,Name,Version,Architecture FROM Application;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM DatabaseStatus;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS ApplicationFile (AppId integer,FileId integer,PRIMARY KEY (AppId, FileId)FOREIGN KEY (FileId) REFERENCES File(FileId));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT INTO ApplicationCode (AppId,Code,CodeType) VALUES (?1, ?2, ?3);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE RowId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS Application (AppIdinteger PRIMARY KEY,Stale text NOT NULL,Nametext NOT NULL,Version text,ModifiedVersiontext,InstallSource text,Publisher text,IsStandalonetext,ARPRegistryKeytext collate nocase,AppIsCompletelyScannedtext,Architecturetext,MSIfiletext,Statustext,LastUpdatedinteger,LastSentTimeinteger);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT FileId,Path,Sha256,Publisher,Sigflags,ModernApp FROM File WHERE status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS ApplicationInstallLocation (AppId integer,InstallLocationId integer,InstallLocationtext NOT NULL,IsStandalonetext,PRIMARY KEY (AppId, InstallLocationId)FOREIGN KEY (AppId) REFERENCES Application(AppId));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET MSIfile=?11,ProcessName=?2,Stale=?5,LastUpdated=?70,LastSentTime=?71 WHERE Path=?1 AND Sha256 LIKE ?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE Path=?1 AND Sha256 LIKE ?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT DISTINCT AppId FROM ApplicationInstallLocation INNER JOIN File ON (File.Path BETWEEN (ApplicationInstallLocation.InstallLocation || '\') AND (ApplicationInstallLocation.InstallLocation || 'hex(7F)') AND File.Status != 'unchanged');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2441979277.0000000003E01000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2439191366.00000000006B7000.00000008.00000001.01000000.00000007.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT COUNT(*) FROM File WHERE status != 'unchanged' AND IsScriptFile=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS Service (ServiceId integer PRIMARY KEY,FileId integer,ServiceName text NOT NULL,Argumentstext NOT NULL,StartType integer NOT NULL,ServiceType integer NOT NULL,UserAccount text NOT NULL,DisplayName text NOT NULL,Description text NOT NULL,FOREIGN KEY (FileId) REFERENCES File(FileId));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Stale=?5,LastUpdated=?70,LastSentTime=?71,Status='modified' WHERE Status != 'deleted' AND LastSentTime != 0 ;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Application WHERE Stale=?5;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS ApplicationCode (AppId integer,Code text NOT NULL,CodeTypetext NOT NULL,PRIMARY KEY (AppId, Code)FOREIGN KEY (AppId) REFERENCES Application(AppId));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET InstallSource=?4,LastUpdated=?70,LastSentTime=?71 WHERE Name=?2 AND Version LIKE ?3 AND Architecture LIKE ?10;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT INTO ApplicationInstallLocation (AppId,InstallLocationId,InstallLocation,IsStandalone) VALUES (?1,COALESCE((SELECT MAX(InstallLocationId) + 1 FROM ApplicationInstallLocation WHERE AppId=?1),1),?3,?35);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO ApplicationFile (AppId, FileId) SELECT DISTINCT ?1, FileId FROM File f, (SELECT ApplicationInstallLocation.InstallLocation, ApplicationInstallLocation.IsStandalone, Application.InstallSource, Application.Version, Application.MSIfile FROM ApplicationInstallLocation INNER JOIN Application ON ApplicationInstallLocation.AppId = Application.AppId WHERE Application.AppId=?1 AND Application.Status != 'deleted' AND Application.IsStandalone = 'false') a WHERE (a.IsStandalone = 'false') AND (a.MSIfile=f.MSIfile) AND (a.MSIfile != '') AND f.IsScriptFile=?4 AND f.IsStandalone='false';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE Sha256=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2441979277.0000000003E01000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2439191366.00000000006B7000.00000008.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Stale=?5,LastUpdated=?70,LastSentTime=?71,Status='modified' WHERE Status !='new' AND Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT INTO Process (ProcessId,Pid,PPid,FileId,ParentPath,Name,SandboxName,PortalFlag,Reputation,User,Session,CommandLine,Lineage,LastUpdated,LastSentTime) VALUES (COALESCE((SELECT MAX(ProcessId) + 1 FROM Process),1),?1, ?2,?20,?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?70, ?71);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE ScanHistory SET ScanStatus=?21, ScanActive=?22, LastUpdated=?70 WHERE ScanActive='true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE FileId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS DatabaseStatus (StatusId integer PRIMARY KEY,InitialScanCountinteger,InitialScanCountTimeinteger,ScanPerformedAfterEntitlementinteger,ScanPerformedAfterEntitlementTimeinteger,DeltaSequenceNumberinteger,FileSequenceNumberinteger,OperationIsActiveinteger);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status='deleted',LastSentTime=0 WHERE FileId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT Path,SHA256,Status FROM File WHERE FileId IN (SELECT DISTINCT FileId FROM ApplicationFile WHERE AppId=?1);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS Process (ProcessId integer PRIMARY KEY,Pid integer,PPidinteger,FileId integer,ParentPathtext NOT NULL,Name text NOT NULL,SandboxName text NOT NULL,PortalFlaginteger,Reputationtext,User text,Sessioninteger,CommandLine text,Lineage integer,LastUpdatedinteger,LastSentTimeinteger);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Architecture=?54,LastUpdated=?70,LastSentTime=?71 WHERE AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE Stale=?5;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE Path BETWEEN (?1 || '\') AND (?1 || 'hex(7F)');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM ApplicationCode WHERE AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT FileId,Path,Sha256 FROM File WHERE Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status='deleted',LastSentTime=0 WHERE AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM ScanHistory WHERE AppCtrlIniSHA256=?10 AND ScanStatus!='completed';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT COUNT(*) FROM Process WHERE LastSentTime=?71;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO File (FileId,Path,ProcessName,Sha256,Stale,CompanyName,Publisher,Sigflags,ProductName,ApplicationLaunchPoint,Version,Description,ProductVersion,OriginalFilename,Size,IsStandalone,WhitelistDrift,WhitelistSource,WhitelistedTime,IsScriptFile,ModernApp,MSIfile,Status,normalized_path,FolderID,LastUpdated,LastSentTime) VALUES ((SELECT FileId FROM File WHERE Path=?1 AND Sha256=?4),?11, ?2,?24,?5,?6,?18,?19,?7,?8,?12,?13,?14,?15,?16,?35,?40,?41,?42,?50,?53,?54,?55,?60,?68,?70,?71);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT DISTINCT AppId FROM Application INNER JOIN File ON (File.ProductName=Application.Name AND ((File.ProductVersion BETWEEN Application.Version AND (Application.Version || 'hex(7F)')) OR (File.ProductVersion BETWEEN Application.ModifiedVersion AND (Application.ModifiedVersion || 'hex(7F)'))) AND File.Status != 'unchanged');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT FileId FROM File;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT AppId,Name,Version FROM Application WHERE ((Name=?2 AND Version LIKE ?3 AND Architecture LIKE ?10) OR (Application.AppId IN (SELECT Application.AppId FROM Application INNER JOIN ApplicationInstallLocation ON (ApplicationInstallLocation.InstallLocation=?60) WHERE Version LIKE ?3 AND Application.AppId=ApplicationInstallLocation.AppId)));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO ApplicationFile (AppId, FileId) SELECT DISTINCT ?1, FileId FROM File f, (SELECT Application.Name, Application.Version, Application.ModifiedVersion, Application.InstallSource FROM Application WHERE Application.AppId=?1 AND Application.Status != 'deleted' AND Application.IsStandalone = 'false') a WHERE (f.ProductName=a.Name) AND ((f.ProductVersion BETWEEN a.Version AND (a.Version || 'hex(7F)')) OR (f.ProductVersion BETWEEN a.ModifiedVersion AND (a.ModifiedVersion || 'hex(7F)'))) AND f.IsScriptFile=?4 AND f.IsStandalone='false';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT AppId FROM ApplicationFile WHERE FileId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Platform;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT Path,Sha256,Status FROM File WHERE FileId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT AppId,Name,Version FROM Application WHERE ARPRegistryKey=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT Path,Sha256,Status FROM File WHERE Path=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET WhitelistDrift=?11,WhitelistSource=?12,WhitelistedTime=?13,Stale=?5,LastUpdated=?70,LastSentTime=?71 WHERE Path=?1 AND Sha256 LIKE ?4 AND (WhitelistDrift!=?11 OR WhitelistedTime!=?13);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Stale=?5,LastUpdated=?70,LastSentTime=?71,Status='modified' WHERE Status != 'deleted' AND LastSentTime != 0 AND AppId IN (SELECT DISTINCT x.AppId FROM File f INNER JOIN ApplicationFile x ON (x.FileId = f.FileId) WHERE f.Stale = 'true');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO Platform (StatusId, device_os_platform, device_os_servicepack, device_os_version) VALUES ((SELECT StatusId FROM Platform WHERE StatusId=?1),?10, ?11, ?12);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status='deleted',LastSentTime=0 WHERE Path=?1 AND Sha256 != ?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status='deleted',LastSentTime=0 WHERE Path=?1 AND Sha256 = ?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Process SET LastSentTime=?8 WHERE LastSentTime<=?6;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Application WHERE AppId IN (SELECT AppId FROM ApplicationInstallLocation WHERE InstallLocation=?1) AND Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0BEGIN EXCLUSIVE;PRAGMA vacuum_db.synchronous=OFFATTACH '' AS vacuum_db;cannot VACUUM from within a transactionwin32
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM ApplicationInstallLocation WHERE AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM File WHERE IsScriptFile=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT FileId FROM ApplicationFile WHERE AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE ScanHistory SET LastDiscoverySourceScanned=?15,LastLocationScanned=?20, LastUpdated=?70 WHERE ScanActive='true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status='deleted',LastSentTime=0 WHERE AppId IN (SELECT DISTINCT AppId FROM ApplicationInstallLocation WHERE (InstallLocation=?1) AND (Version=?2));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT COUNT(*) FROM Application WHERE status != 'unchanged' AND AppIsCompletelyScanned = 'true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET MSIfile=?11,ProcessName=?2,Stale=?5,LastUpdated=?70,LastSentTime=?71 WHERE MSIfile=?55 AND Path=?1 AND Sha256 != ?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT OR REPLACE INTO DatabaseStatus (StatusId, InitialScanCount, InitialScanCountTime, ScanPerformedAfterEntitlement, ScanPerformedAfterEntitlementTime, DeltaSequenceNumber, FileSequenceNumber, OperationIsActive) VALUES ((SELECT StatusId FROM DatabaseStatus WHERE StatusId=?1),?10, ?11,?20, ?21,?31, ?32,?41);
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET ARPRegistryKey=?1 WHERE AppId=?2;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM ScanHistory;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Application WHERE Status=?4 AND Stale LIKE ?5 AND AppIsCompletelyScanned=?7;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status='modified',Stale='true',LastUpdated=?70,LastSentTime=?71 WHERE (Status != 'new') AND (Status != 'deleted') AND AppId IN (SELECT DISTINCT x.AppId FROM File f INNER JOIN ApplicationFile x ON (x.FileId = f.FileId) WHERE f.Status != 'unchanged');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Service WHERE FileId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT FileId FROM File WHERE Stale=?5;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT Path,SHA256,Status FROM File WHERE FileId NOT IN (SELECT FileId From ApplicationFile) AND IsScriptFile=?4;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET AppIsCompletelyScanned=?7,LastUpdated=?70 WHERE AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status='new' WHERE Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS BlackCache (filepath varchar(300) UNIQUE,atime char(255));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS MasterApplication (MasterAppIdinteger PRIMARY KEY,Nametext,Version text,Architecture text,InstallLocationtext,AppIdinteger,FOREIGN KEY (AppId) REFERENCES Application(AppId));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status=?9,LastSentTime=?8 WHERE AppIsCompletelyScanned = 'true' AND Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Stale=?5,LastUpdated=?70,LastSentTime=?71,Status='modified' WHERE Path=?1 AND Sha256 LIKE ?4 AND Status != 'new' AND Status != 'deleted' AND (LastSentTime != 0 OR Status = 'unchanged');
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Status=?9,LastSentTime=?8 WHERE Status != 'unchanged' AND Status != 'deleted' AND AppIsCompletelyScanned = 'true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT Path,SHA256,Status FROM File WHERE FileId NOT IN (SELECT FileId From ApplicationFile) AND IsScriptFile=?4 AND Status != 'unchanged';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status=?9,LastSentTime=?8 WHERE IsScriptFile=?4 AND Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS ScanHistory (ScanId integer PRIMARY KEY,AppCtrlIniSHA256text,SectionNametext,LastDiscoverySourceScannedtext,LastLocationScannedtext,ScanStatustext,ScanActivetext,LastUpdatedinteger,UNIQUE (AppCtrlIniSHA256,SectionName));
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status='deleted',LastSentTime=0 WHERE Stale='true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET MSIfile=?54,LastUpdated=?70,LastSentTime=?71 WHERE Name=?2 AND Version LIKE ?3 AND Architecture LIKE ?10;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE File SET Status='new' WHERE Status != 'deleted';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT * FROM Application WHERE AppIsCompletelyScanned='true';
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.0000000010375000.00000004.00001000.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.0000000010119000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE Application SET Stale=?5,LastUpdated=?70,LastSentTime=?71,Status='modified' WHERE Status != 'deleted' AND LastSentTime != 0 AND AppId=?1;
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: SELECT FileId FROM File WHERE Path=?1 AND Sha256 LIKE ?4;
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2028,i,2931579537296338705,3953823219278610053,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maveuve.github.io/frlpodf/marynewreleasefax.html"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe"
Source: unknown Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe"
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe"
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe"
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: unknown Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2028,i,2931579537296338705,3953823219278610053,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe" Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe" Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: oledlg.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: k7rn7l32.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ntd3ll.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: oledlg.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: k7rn7l32.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ntd3ll.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Section loaded: oledlg.dll Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: /app/crashsubmit?appname=SumatraPDFhttp://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5.3.0.pdbSumatraPDF.pdblibmupdf.pdbSumatraPDF-no-MuPDF.pdbhttp://kjkpub.s3.amazonaws.com/sumatrapdf/prerel/SumatraPDF-prerelease-SVN_PRE_RELEASE_VER.pdb.zipsymbols_tmp.ziphttp://kjkpub.s3.amazonaws.com/sumatrapdf/rel/SumatraPDF-1.5.3.0.pdb.zipsymbols_tmp.zipSUMATRAPDF_FULLDUMPHaihaisoft PDF Reader crashedSorry, that shouldn't have happened! source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: SumatraPDF-no-MuPDF.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: SumatraPDF-1.5.3.0.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: E:\building\360project\360sd\branches\beta\Build\x86\WhiteCache.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2323953234.000000001013D000.00000002.00000001.01000000.00000005.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000002.2324907056.000000001039B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\workspace\_AppDiscovery_AppDiscovery_1.3.0@2\dev\AppDiscovery_scanner\scanner\src\ADScan\Release\bin\ADScan\ADScan.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2415952110.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2426201068.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2418692627.0000000003F60000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2422479886.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000013.00000000.2438293164.000000000061E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: xOdx>a0m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: libmupdf.pdb source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 00000009.00000000.2148958453.00000000006C9000.00000002.00000001.01000000.00000004.sdmp

Data Obfuscation
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Unpacked PE file: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack
PE file contains an invalid checksum
Source: build.exe.13.dr Static PE information: real checksum: 0x2ef980 should be: 0x3ec133
Creates processes with suspicious names
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: \my organizer 2023 mortgage interest paymentspdf.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe File created: C:\Users\user\AppData\Local\Temp\build.exe Jump to dropped file

Boot Survival
barindex
Creates autostart registry keys with suspicious names
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *UpdaterCisco Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *UpdaterCisco Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *UpdaterCisco Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000E45000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000003.2313438225.0000000000E23000.00000004.00000800.00020000.00000000.sdmp, MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe, 0000000D.00000002.2563583207.0000000000E29000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe "C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe" Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2423957132.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 6148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 5652, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-9QRTYQ Jump to behavior
Source: C:\Users\user\Downloads\Marys Organizer 2023 Release\MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-9QRTYQ Jump to behavior
Yara detected Remcos RAT
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10163f0e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.2850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2423957132.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2324228645.0000000010163000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2323301889.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563583207.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 6148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe PID: 5652, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1518509 URL: https://maveuve.github.io/f... Startdate: 25/09/2024 Architecture: WINDOWS Score: 100 40 privmerkt.com 2->40 42 nwemarkets.com 2->42 44 geoplugin.net 2->44 60 Suricata IDS alerts for network traffic 2->60 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 7 other signatures 2->66 8 MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe 1 2->8         started        10 chrome.exe 21 2->10         started        14 MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe 2->14         started        16 3 other processes 2->16 signatures3 process4 dnsIp5 18 MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe 3 15 8->18         started        23 cmd.exe 1 8->23         started        56 192.168.2.16 unknown unknown 10->56 58 239.255.255.250 unknown Reserved 10->58 38 Marys Organizer 2023 Release.zip (copy), Zip 10->38 dropped 25 chrome.exe 10->25         started        27 MY ORGANIZER 2023 Mortgage Interest PaymentsPDF.exe 14->27         started        file6 process7 dnsIp8 46 privmerkt.com 172.111.163.227 AMANAHA-NEWCA United States 18->46 48 geoplugin.net 178.237.33.50 ATOM86-ASATOM86NL Netherlands 18->48 36 C:\Users\user\AppData\Local\Temp\build.exe, PE32 18->36 dropped 68 Detected Remcos RAT 18->68 29 build.exe 18->29         started        31 reg.exe 1 1 23->31         started        34 conhost.exe 23->34         started        50 www.google.com 142.250.186.68 GOOGLEUS United States 25->50 52 216.58.212.164 GOOGLEUS United States 25->52 54 6 other IPs or domains 25->54 file9 signatures10 process11 signatures12 70 Creates autostart registry keys with suspicious names 31->70
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.68
 www.google.com United States
15169 GOOGLEUS false
104.18.10.207
 stackpath.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
216.58.212.164
 unknown United States
15169 GOOGLEUS false
104.18.94.41
 unknown United States
13335 CLOUDFLARENETUS false
104.18.95.41
 challenges.cloudflare.com United States
13335 CLOUDFLARENETUS false
140.82.121.4
 github.com United States
36459 GITHUBUS false
185.199.111.133
 raw.githubusercontent.com Netherlands
54113 FASTLYUS false
172.111.163.227
 privmerkt.com United States
32489 AMANAHA-NEWCA true
239.255.255.250
 unknown Reserved
unknown unknown false
185.199.108.153
 maveuve.github.io Netherlands
54113 FASTLYUS false
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
stackpath.bootstrapcdn.com 104.18.10.207 true
privmerkt.com 172.111.163.227 true
github.com 140.82.121.4 true
nwemarkets.com 45.74.48.2 true
challenges.cloudflare.com 104.18.95.41 true
raw.githubusercontent.com 185.199.111.133 true
geoplugin.net 178.237.33.50 true
www.google.com 142.250.186.68 true
maveuve.github.io 185.199.108.153 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8c7bc1cab943c1&lang=auto false
  • Avira URL Cloud: safe
 unknown
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js false
  • Avira URL Cloud: safe
 unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css false
  • Avira URL Cloud: safe
 unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8c7ad8c96941a6&lang=auto false
  • Avira URL Cloud: safe
 unknown
https://raw.githubusercontent.com/maveuve/vbdsz/refs/heads/main/Marys%20Organizer%202023%20Release.zip false
  • Avira URL Cloud: safe
 unknown
https://maveuve.github.io/frlpodf/marynewreleasefax.html false
    		unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c8c7bc1cab943c1/1727282716834/454bfa27911b53eaf89b77fb676ac9ea7d67d7c4009c0340595e1039d45fc476/ANn6E4_AEvWbw_F false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c8c7ad8c96941a6/1727282678373/4K3pZlDmL6zt7ib false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5renj/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/ false
    • Avira URL Cloud: safe
    		 unknown
    privmerkt.com true
    • Avira URL Cloud: malware
    		 unknown
    https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9m1ve/0x4AAAAAAAktEy218PeM5fmO/auto/fbE/normal/auto/ false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/784762221:1727280895:DpZwutPQnAJ2xMIFwpiobNTMBlYJp9CWXlp9V5GN5Yo/8c8c7bc1cab943c1/4904f693d598ee1 false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/621320543:1727280800:x-uSLD9blvM2sN0MY5eDk1KX-nemuunHuqvoVAWU97E/8c8c7ad8c96941a6/596e5d08887dcbd false
    • Avira URL Cloud: safe
    		 unknown
    http://geoplugin.net/json.gp false
    • URL Reputation: safe
    		 unknown
    https://maveuve.github.io/favicon.ico false
    • Avira URL Cloud: safe
    		 unknown
    https://github.com/maveuve/vbdsz/raw/refs/heads/main/Marys%20Organizer%202023%20Release.zip false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c8c7bc1cab943c1/1727282716836/wNiz968zyhOEG8- false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c8c7ad8c96941a6/1727282678369/d41a30965b817c48f2b8012ecc5d4118160944ab876415a0adeddf7d6fb64e62/cwl0dNi4gO4wp8F false
    • Avira URL Cloud: safe
    		 unknown